https://community.splunk.com/t5/Splunk-Search/How-to-find-the-data-from-nested-log/m-p/510291#M142799 <P>try <STRONG>spath</STRONG> , <STRONG>mvexpand</STRONG> , make <STRONG>table</STRONG> and <STRONG>search</STRONG> what you want.</P> Tue, 21 Jul 2020 20:34:11 GMT to4kawa 2020-07-21T20:34:11Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-data-from-nested-log/m-p/510245#M142785 <P>I am using below query&nbsp;<BR />index=aws earliest=-12h eventName=AuthorizeSecurityGroupIngress "items{}.cidrIp"="0.0.0.0/0" AND "items{}.port"!=8080 AND "items{}.port"!=22 AND "items{}.port"!=80 AND "items{}.port"!=443&nbsp;</P><P>to get data like if a user is making any changes and using the above-mentioned ports then it is not going to show the data and it is giving me the exact results but when I have a log that has nested ports then it is not giving me the actual result. eg</P><P>items: []</P><P>&nbsp; &nbsp; {port: 12345}<BR />&nbsp; &nbsp; {port: 22}<BR />It means if we have a nested log and it contains the above-mentioned ports then it should show the result.</P><P>Any thoughts on this?</P> Tue, 21 Jul 2020 15:09:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-data-from-nested-log/m-p/510245#M142785 john_snow 2020-07-21T15:09:16Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-data-from-nested-log/m-p/510291#M142799 <P>try <STRONG>spath</STRONG> , <STRONG>mvexpand</STRONG> , make <STRONG>table</STRONG> and <STRONG>search</STRONG> what you want.</P> Tue, 21 Jul 2020 20:34:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-data-from-nested-log/m-p/510291#M142799 to4kawa 2020-07-21T20:34:11Z