topic Re: ITSI Entity Object API results eval help in Splunk ITSI

ITSI Entity Object API results eval help

cdemir — Wed, 30 Sep 2020 05:16:43 GMT

I finally figured out how to use the entity rest API object to pull my informational values. Only problem is I can't figure out how to dynamically assign key value pairs to table from multivalue json arrays. This is as far as I have gotten and would greatly appreciate your eyes and time:

| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/entity
fields="_key,title,identifier,informational,identifying_name" report_as=text
| eval value=spath(value,"{}")
| mvexpand value
| eval entity_title=spath(value, "title"),
entity_name=spath(value, "identifying_name"),
entity_aliases=mvzip(spath(value, "identifier.fields{}"),spath(value, "identifier.values{}"),"="),
entity_info=mvzip(spath(value, "informational.fields{}"),spath(value, "informational.values{}"),"="),
cpu_cores=spath(value, "informational.values{0}")

The second to last eval brings the informational values I want together, but as a multi-value field. The last eval is a straight set my value to this array value eval. I would like to attempt to do that without having to hard set it for every value. Not every entity is configured the same (I am not above clearing out my 16,000 entities and forcing standard entry by users). Dynamically creating the key value pairs as single value fields would be much more palatable instead.

I appreciate any help at all.

Re: ITSI Entity Object API results eval help

to4kawa — Sat, 02 May 2020 23:16:59 GMT

...
| eval entity_title=spath(value, "title"),
entity_name=spath(value, "identifying_name"),
entity_aliases=mvzip(spath(value, "identifier.fields{}"),spath(value, "identifier.values{}"),"="),
entity_info=mvzip(spath(value, "informational.fields{}"),spath(value, "informational.values{}"),"="),
cpu_cores=spath(value, "informational.values{0}")
| rename entity_name as _raw
| kv
| renmae entity_aliases as _raw
| kv
| rename info as _raw
| kv
| fields - _raw

A little trick.

your spath usage is nice.

Re: ITSI Entity Object API results eval help

cdemir — Sun, 03 May 2020 18:06:06 GMT

Oh man! That is a nifty trick. I had no idea I could do that and does exactly what I needed it to. You're awesome and thank you for the assistance.

Re: ITSI Entity Object API results eval help

sandrosov_splun — Wed, 23 Sep 2020 12:08:15 GMT

Another trick that worked for me.

| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/entity report_as=text | eval value=spath(value,"{}") | mvexpand value | eval info_fields=spath(value,"informational.fields{}"), alias_fields=spath(value,"identifier.fields{}"), entity_id=spath(value, "_key"), entity_title=spath(value, "title"), entity_name=spath(value, "identifying_name") | appendpipe [ | mvexpand alias_fields | eval field_value = spath(value,alias_fields."{}"), field_type="alias" | rename alias_fields as field_name ] | appendpipe [ | where isnull(field_type) | mvexpand info_fields | eval field_value = spath(value,info_fields."{}"), field_type="info" | rename info_fields as field_name ] | where isnotnull(field_type) | table entity_id entity_name entity_title field_name field_value field_type