topic Re: multiple case statement not working in Splunk Search

multiple case statement not working

samneo — Mon, 08 Nov 2021 12:48:04 GMT

Im working with JSON data and the structure is as per the below

data: { [-] application: { [+] } completedAt: 1636133794444 environments: [ [-] { [-] id: XNu1-l8oROOOSM5gpoSR0g } { [-] id: _LY0B7VpRq64tHXq7Uy55A } { [-] id: 7KbvgSBMSUSUyAn2hMXSQA } { [-] id: dJ7EuItjSG2M47-zvIvimQ } ]

Now when i use a case function for this like the below:

|eval env = case('data.environments{}.id'=="7KbvgSBMSUSUyAn2hMXSQA", "prd-au", 'data.environments{}.id'=="_LY0B7VpRq64tHXq7Uy55A", "prd-gb")

It only ever brings me back 1 result and thats whatever is placed first in the case function so the above returns prd-au and if i swap the values around then it will return prd-gb. I presume this is something to do with how the JSON data is working with splunk causing it to error out but unsure how to resolve?

any ideas?

Re: multiple case statement not working

ITWhisperer — Mon, 08 Nov 2021 13:04:14 GMT

Splunk is working with a pipeline of events - the events in the pipeline include multivalue fields such as data.environments{}.id - the eval case finds a match among the multivalues for the first test hence you get the results you are getting

Re: multiple case statement not working

samneo — Mon, 08 Nov 2021 13:05:24 GMT

thanks @ITWhisperer is there a way round this so i can get all values?

Re: multiple case statement not working

ITWhisperer — Mon, 08 Nov 2021 13:09:43 GMT

You would need to expand the event into multiple events, try something like this

| mvexapnd 'data.environments{}.id'