topic Re: How to search against multiple elements in Splunk Search

How to search against multiple elements

47024 — Wed, 20 Nov 2019 16:52:22 GMT

I'm trying to capture occurrences when multiple criteria are true in an event where elements can exist multiple times in the message.

For example, with the below event I want to capture how often events have an element that is both id=A and width>600.

Because there are multiple walls I can easily filter when any element has an id=A or a width>600, but I cannot figure out how to filter where both criteria are met.

Example message below:

elements: [
   {
      id: A
      width: 585
   }
   {
      id: B
      width: 605
   }
]

Re: How to search against multiple elements

aberkow — Wed, 30 Sep 2020 03:02:49 GMT

You can either leverage the spath command https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Spath to make the data easier to work with, or look at the answer posted here: https://answers.splunk.com/answers/784418/dynamic-loop-through-a-json-array-looking-for-trig.html#answer-785479

Essentially, you need to create a pairing between id and width, separate them into their own rows, index them out, and then run your search:

{code}
your_base_search
| eval id_zip_width=mvzip(id,width)
| mvexpand id_zip_width
| eval id_zip_width=split(id_zip_width,",")
| eval id=mvindex(id_zip_width,0)
| eval width=mvindex(id_zip_width,1)
| search id="A" and width>600
{code}

Hope this helps!

Re: How to search against multiple elements

woodcock — Wed, 20 Nov 2019 22:46:39 GMT

Like this:

... | eval _raw = mvzip(id, width, "=")
| kv
| where A>600

Re: How to search against multiple elements

47024 — Fri, 22 Nov 2019 14:19:47 GMT

This worked! Thank you very much.

Re: How to search against multiple elements

woodcock — Fri, 22 Nov 2019 15:49:14 GMT

Be sure to try mine; it should scale better and is much shorter.