topic Re: Correlation of 2 fields within json array in Splunk Enterprise

Correlation of 2 fields within json array

galsegal — Mon, 20 Jul 2020 08:32:03 GMT

Hey All,

What I'm trying to do is to build a search query that correlates between fields like in the below example:

I need that where message.anomaly.features{}.anomaly has a true value, then to output a new field with the corresponding fields below - 23, location (Even only one of them is good for me)

How can I accomplish that?

Thank you,

Re: Correlation of 2 fields within json array

anmolpatel — Mon, 20 Jul 2020 09:20:59 GMT

@galsegal Is this what you're after ?

| makeresults | eval _raw="{ \"Features\": [ { \"anomaly\": false, \"id\" : 25, \"name\" : \"service\" }, { \"anomaly\": true, \"id\" : 23, \"name\" : \"location\" }, { \"anomaly\": false, \"id\" : 24, \"name\" : \"ip\" }, { \"anomaly\": false, \"id\" : 27, \"name\" : \"time\" } ] }" | rename COMMENT AS "The code below is what is needed. First extract each value from the tree, than we group and split them based on how they are related." | spath path="Features{}.anomaly" output=anomaly | spath path="Features{}.id" output=id | spath path="Features{}.name" output=name | eval x = mvzip(mvzip(id, anomaly, "\n"), name, "\n") | mvexpand x | eval x=split(x,"\n") | eval ID = mvindex(x, 0) | eval Name = mvindex(x, 1) | eval Anomaly = mvindex(x, 2) | stats values(Name) as Name values(Anomaly) as Anomaly by ID

Re: Correlation of 2 fields within json array

galsegal — Mon, 20 Jul 2020 10:16:44 GMT

This was not 100% the solution but it indeed got me there 🙂

Thank you very much, sir.