topic How to avoid duplicate values in search? in Splunk Search

How to avoid duplicate values in search?

chetanN — Thu, 29 Dec 2022 04:15:19 GMT

Hi all,

I am very new to Splunk and trying to learn it. Following is my JSON:

{
TrainID=AA11
TrainData: [
{

ConnectingTrain: {
TR1: {
connectionTime: 59
TotalPassengers: 44
},
}
}
]

connectionTime : 38
}

Here I want to print the value of connection time which is under TR1 and not the one that is a duplicate variable having a different value.

Appreciate any pointers here.

Thanks,

Chetan

Re: How to avoid duplicate values in search

gcusello — Tue, 27 Dec 2022 17:51:27 GMT

Hi @chetanN,

use the spath command to extract all the fields from your data source and then choose the one you want.

<your_search> | spath

for more infos see at https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath

Ciao.

Giuseppe

Re: How to avoid duplicate values in search

PickleRick — Tue, 27 Dec 2022 19:05:11 GMT

As @gcusello said - spath is the way (or at least one of the ways) to deal with json data. One caveat though regarding jsons - Splunk's handling of json can be perceived as sub-par sometimes. Splunk doesn't handle well the "nestedness" of json data - it expects a simple "tabular" structure of your events where you simply have fields with given names and their values (possibly multiple values in one multivalued field). So it doesn't handle well such structures where you can have nested arrays of objects which contain arrays... and so on. And you have at least three different ways of dealing with json data - indexed extractions, auto-kv and manual spath, each having its pros and cons.

So for a newbie you chose a quite advanced topic 🙂