How achieve a conjunction (AND operator) in a JSON nested Key-value(KV) array

T0n1g3 — Fri, 26 Mar 2021 21:12:40 GMT

Event Data:
{"Debug":[
{"Action":"User-Created","Result":"OK"},
{"Action":"Granted-Permissions","Result":"Failed"}
]}

My try:
# Get the events where Action equal "User-Created" and Result="Failed"
Search: index=index_name Debug{}.Action="User-Created" AND Debug{}.Result="Failed"

Expected:
No records should be returned because there are not a single record where the two values are true.

Result:
Multiple records returned, conjunction is not being performed, it operates like an OR logical function.

Notes:
It works if I choose simple not KV data.

Thanks,

Re: How achieve a conjunction (AND operator) in a JSON nested Key-value(KV) array

ITWhisperer — Sat, 27 Mar 2021 00:13:44 GMT

The filter on the search is returning events that have both strings. Both strings appear in your event.

You either have to include the whole string (escaping double quotes as necessary) "\"User-Created\",\"Result\":\"Failed\"" or you have to mvexpand (or similar) the Debug array into separate events and then filter those events.

topic How achieve a conjunction (AND operator) in a JSON nested Key-value(KV) array in Splunk Search

How achieve a conjunction (AND operator) in a JSON nested Key-value(KV) array

Re: How achieve a conjunction (AND operator) in a JSON nested Key-value(KV) array