topic Splunk searching nested json in Splunk Search

Splunk searching nested json

blaku — Tue, 29 Sep 2020 20:50:56 GMT

Hello
I use automatic translation because I am not good at English. sorry.

I took NVD 's CVE list (Json Feed) into Splunk.
That's index="testIndex" product_name = "openssl" "version_data" = "1.6.0" Searching with
There is no "1.6.0" in the version of openssl

I want to link product with version but it does not work as expected.
I can't get spath or mvexpand to extract the nested arrays properly
Someone help me.

 {
            "cve" : {
              "CVE_data_meta" : {
                "ID" : "CVE-2013-0169",
                "ASSIGNER" : "cve@mitre.org"
              },
              "affects" : {
                "vendor" : {
                  "vendor_data" : [ {
                    "vendor_name" : "openssl",
                    "product" : {
                      "product_data" : [ {
                        "product_name" : "openssl",
                        "version" : {
                          "version_data" : [ {
                            "version_value" : "*"
                          }, {
                            "version_value" : "0.9.8"
                          }, {
                            "version_value" : "0.9.8a"
                          }, {
                            "version_value" : "0.9.8b"
                          }, {
                            "version_value" : "0.9.8c"
                          }, {
                            "version_value" : "0.9.8d"
                          }, {
                            "version_value" : "0.9.8f"
                          }, {
                            "version_value" : "0.9.8g"
                          } ]
                        }
                      } ]
                    }
                  }, {
                    "vendor_name" : "oracle",
                    "product" : {
                      "product_data" : [ {
                        "product_name" : "openjdk",
                        "version" : {
                          "version_data" : [ {
                            "version_value" : "-"
                          }, {
                            "version_value" : "1.6.0"
                          }, {
                            "version_value" : "1.7.0"
                          } ]
                        }
                      } ]
                    }
                  }, {
                    "vendor_name" : "polarssl",
                    "product" : {
                      "product_data" : [ {
                        "product_name" : "polarssl",
                        "version" : {
                          "version_data" : [ {
                            "version_value" : "0.10.0"
                          }, {
                            "version_value" : "0.10.1"
                          }, {
                            "version_value" : "0.11.0"
                          } ]
                        }
                      } ]
                    }
                  } ]
                }
              }
            },
            "publishedDate" : "2013-02-08T19:55Z",
            "lastModifiedDate" : "2018-08-09T01:29Z"
          }

Re: Splunk searching nested json

renjith_nair — Sun, 12 Aug 2018 08:11:41 GMT

@blaku,

Try

|makeresults |eval json="  {
             \"cve\" : {
               \"CVE_data_meta\" : {
                 \"ID\" : \"CVE-2013-0169\",
                 \"ASSIGNER\" : \"cve@mitre.org\"
               },
               \"affects\" : {
                 \"vendor\" : {
                   \"vendor_data\" : [ {
                     \"vendor_name\" : \"openssl\",
                     \"product\" : {
                       \"product_data\" : [ {
                         \"product_name\" : \"openssl\",
                         \"version\" : {
                           \"version_data\" : [ {
                             \"version_value\" : \"*\"
                           }, {
                             \"version_value\" : \"0.9.8\"
                           }, {
                             \"version_value\" : \"0.9.8a\"
                           }, {
                             \"version_value\" : \"0.9.8b\"
                           }, {
                             \"version_value\" : \"0.9.8c\"
                           }, {
                             \"version_value\" : \"0.9.8d\"
                           }, {
                             \"version_value\" : \"0.9.8f\"
                           }, {
                             \"version_value\" : \"0.9.8g\"
                           } ]
                         }
                       } ]
                     }
                   }, {
                     \"vendor_name\" : \"oracle\",
                     \"product\" : {
                       \"product_data\" : [ {
                         \"product_name\" : \"openjdk\",
                         \"version\" : {
                           \"version_data\" : [ {
                             \"version_value\" : \"-\"
                           }, {
                             \"version_value\" : \"1.6.0\"
                           }, {
                             \"version_value\" : \"1.7.0\"
                           } ]
                         }
                       } ]
                     }
                   }, {
                     \"vendor_name\" : \"polarssl\",
                     \"product\" : {
                       \"product_data\" : [ {
                         \"product_name\" : \"polarssl\",
                         \"version\" : {
                           \"version_data\" : [ {
                             \"version_value\" : \"0.10.0\"
                           }, {
                             \"version_value\" : \"0.10.1\"
                           }, {
                             \"version_value\" : \"0.11.0\"
                           } ]
                         }
                       } ]
                     }
                   } ]
                 }
               }
             },
             \"publishedDate\" : \"2013-02-08T19:55Z\",
             \"lastModifiedDate\" : \"2018-08-09T01:29Z\"
           }"
           |spath input=json output=product_name path=cve.affects.vendor.vendor_data{}.product{}.product_data{}.product_name
           |spath input=json output=version path=cve.affects.vendor.vendor_data{}.product{}.product_data{}.version 
           |eval z=mvzip(product_name,version,"#")|table z| mvexpand z
           |eval s=split(z,"#")|eval Product=mvindex(s,0),Version=mvindex(s,1)|fields Product,Version
           |spath input=Version output=Versions path=version_data{}.version_value
           |table Product,Versions
           |mvexpand Versions

Re: Splunk searching nested json

afroz — Tue, 29 Sep 2020 20:54:13 GMT

Hi,

Map JSON logs to _json sourcetype.

In the props.conf file create stanza like below.

[_json]
KV_MODE= json

It will extract fields. So don't need to search nested json files. Just search fields you require.

Re: Splunk searching nested json

blaku — Wed, 15 Aug 2018 04:23:19 GMT

@renjith.nair
Hi
When I tried it worked without problem.
It is movement as expected.
Thank you very much

Re: Splunk searching nested json

vmacedo — Wed, 04 Dec 2019 20:39:02 GMT

Here is another solution, but this one does not need mvzip, split or mvindex:

|makeresults |eval json="  {
              \"cve\" : {
                \"CVE_data_meta\" : {
                  \"ID\" : \"CVE-2013-0169\",
                  \"ASSIGNER\" : \"cve@mitre.org\"
                },
                \"affects\" : {
                  \"vendor\" : {
                    \"vendor_data\" : [ {
                      \"vendor_name\" : \"openssl\",
                      \"product\" : {
                        \"product_data\" : [ {
                          \"product_name\" : \"openssl\",
                          \"version\" : {
                            \"version_data\" : [ {
                              \"version_value\" : \"*\"
                            }, {
                              \"version_value\" : \"0.9.8\"
                            }, {
                              \"version_value\" : \"0.9.8a\"
                            }, {
                              \"version_value\" : \"0.9.8b\"
                            }, {
                              \"version_value\" : \"0.9.8c\"
                            }, {
                              \"version_value\" : \"0.9.8d\"
                            }, {
                              \"version_value\" : \"0.9.8f\"
                            }, {
                              \"version_value\" : \"0.9.8g\"
                            } ]
                          }
                        } ]
                      }
                    }, {
                      \"vendor_name\" : \"oracle\",
                      \"product\" : {
                        \"product_data\" : [ {
                          \"product_name\" : \"openjdk\",
                          \"version\" : {
                            \"version_data\" : [ {
                              \"version_value\" : \"-\"
                            }, {
                              \"version_value\" : \"1.6.0\"
                            }, {
                              \"version_value\" : \"1.7.0\"
                            } ]
                          }
                        } ]
                      }
                    }, {
                      \"vendor_name\" : \"polarssl\",
                      \"product\" : {
                        \"product_data\" : [ {
                          \"product_name\" : \"polarssl\",
                          \"version\" : {
                            \"version_data\" : [ {
                              \"version_value\" : \"0.10.0\"
                            }, {
                              \"version_value\" : \"0.10.1\"
                            }, {
                              \"version_value\" : \"0.11.0\"
                            } ]
                          }
                        } ]
                      }
                    } ]
                  }
                }
              },
              \"publishedDate\" : \"2013-02-08T19:55Z\",
              \"lastModifiedDate\" : \"2018-08-09T01:29Z\"
            }"
            |spath input=json output=product_data path=cve.affects.vendor.vendor_data{}.product{}.product_data{}
            |mvexpand product_data
            |spath input=product_data path=product_name
            |spath input=product_data output=version path=version.version_data{}.version_value
            |mvexpand version
            |table product_name, version

Re: Splunk searching nested json

to4kawa — Thu, 05 Dec 2019 13:38:18 GMT

Great! thank you