How to exclude or select events based on value from key/value array?

btsr — Thu, 09 Feb 2023 18:59:22 GMT

Hi All,

Our JSON payload looks like as shown below. The msg.details array can have any number key/value pairs in any order.

{ "appName": "TestApp", "eventType": "Response", "msg": { "transId": "Trans1234", "status": "Success", "client": "clientXyz", "responseTime": 1650, "details": [ { "keyName": "returnUrl", "keyValue": "https://abc.com/onlineshop?prod=112&cat=1349" }, { "keyName": "customer", "keyValue": "xyz" } ], "url": "/v1/test" } }

I want to filter events using partial wildcard keyValue for a keyName in the array in the msg.details array. Your help is appreciated. Thanks.

index=* appName="TestApp" msg.url="/v1/test" | spath | search msg.details{}.keyName=returnUrl AND msg.details{}.keyValue!="*abc.com*"

The search may include multiple keyValue filters in the array like this. Thanks.

index=* appName="TestApp" msg.url="/v1/test" | spath | search (msg.details{}.keyName=customer AND msg.details{}.keyValue!="xyz") AND (msg.details{}.keyName=returnUrl AND msg.details{}.keyValue!="*abc.com*")

Re: How to exclude or select events based on value from key/value array?

yuanliu — Fri, 10 Feb 2023 07:43:45 GMT

I am rather confused. Your sample code shows exactly what you are asking. In other words, you already have the answer. What is missing? If your code is not returning what you expect, you will need to illustrate the results and explain any difference between what you expect and what you receive.

Side note: Based on your search term, Splunk already extracted from JSON. You don't need another spath. Also, if all operators between logical terms is AND, there is no need to bracket them. Additionally, in search command, default operator is AND, so you can also omit that keyword.

topic Re: How to exclude or select events based on value from key/value array? in Splunk Search

How to exclude or select events based on value from key/value array?

Re: How to exclude or select events based on value from key/value array?