List ITSI entities with all related aliases and informational fields [SOLVED]

sandrosov_splun — Tue, 30 Nov 2021 12:39:14 GMT

Hi Everyone,

I've heard many times that it is challenging to get ITSI entities list with a proper alias and informational fields mapping in ITSI. A circulating SPL query is mixing types of the fields and does not fully solves the issue.

Please check out this SPL script I have created for getting the right dataset.

| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/entity report_as=text | eval value=spath(value,"{}") | mvexpand value | eval info_fields=spath(value,"informational.fields{}"), alias_fields=spath(value,"identifier.fields{}"), entity_id=spath(value, "_key"), entity_title=spath(value, "title"), entity_name=spath(value, "identifying_name") | appendpipe [ | mvexpand alias_fields | eval field_value = spath(value,alias_fields."{}"), field_type="alias" | rename alias_fields as field_name ] | appendpipe [ | where isnull(field_type) | mvexpand info_fields | eval field_value = spath(value,info_fields."{}"), field_type="info" | rename info_fields as field_name ] | where isnotnull(field_type) | table entity_id entity_name entity_title field_name field_value field_type

topic List ITSI entities with all related aliases and informational fields [SOLVED] in Splunk ITSI

List ITSI entities with all related aliases and informational fields [SOLVED]