https://community.splunk.com/t5/Splunk-Search/Compare-values-in-two-different-json-objects/m-p/682254#M233091 <LI-CODE lang="markup">| spath "Action{}" output="Action" | spath "Effect" | mvexpand Action</LI-CODE> Thu, 28 Mar 2024 10:03:07 GMT ITWhisperer 2024-03-28T10:03:07Z https://community.splunk.com/t5/Splunk-Search/Compare-values-in-two-different-json-objects/m-p/682244#M233084 <DIV><P>Hello,&nbsp;</P><P>This question has probably been asked and answered, but I just can't seem to find a best solution.&nbsp;<BR /><BR />So, in the results I want to table the <STRONG>Allow and Deny values</STRONG>. And the second result would be the <STRONG>| search Action=eks* only where the Effect is Allow</STRONG>. I have tried till now, but I cannot relate the Allow action, it lists all values. Thanks in Advance.&nbsp;</P><SPAN><BR /><BR />{ "Action": [</SPAN></DIV><DIV><SPAN>"eks:*",</SPAN></DIV><DIV><SPAN>"ecs:*"</SPAN></DIV><DIV><SPAN>],</SPAN></DIV><DIV><SPAN>"Effect": "Allow"</SPAN></DIV><DIV>&nbsp;</DIV><DIV><SPAN>},</SPAN></DIV><DIV><SPAN>{</SPAN></DIV><DIV><SPAN>"Action": [ </SPAN></DIV><DIV><SPAN>"config:*",</SPAN></DIV><DIV><SPAN>"budgets:*"</SPAN></DIV><DIV><SPAN>],</SPAN></DIV><DIV><SPAN>"Effect": "Deny",</SPAN></DIV><DIV><SPAN>}</SPAN></DIV> Thu, 28 Mar 2024 09:09:57 GMT https://community.splunk.com/t5/Splunk-Search/Compare-values-in-two-different-json-objects/m-p/682244#M233084 barosan007 2024-03-28T09:09:57Z https://community.splunk.com/t5/Splunk-Search/Compare-values-in-two-different-json-objects/m-p/682249#M233087 <P>Please can you give an example of your expected results?</P> Thu, 28 Mar 2024 09:36:52 GMT https://community.splunk.com/t5/Splunk-Search/Compare-values-in-two-different-json-objects/m-p/682249#M233087 ITWhisperer 2024-03-28T09:36:52Z https://community.splunk.com/t5/Splunk-Search/Compare-values-in-two-different-json-objects/m-p/682252#M233090 <TABLE border="1" width="100%"><TBODY><TR><TD width="50%">Action Name</TD><TD width="50%">Effect</TD></TR><TR><TD width="50%">eks</TD><TD width="50%">allow</TD></TR><TR><TD width="50%">ecs</TD><TD width="50%">allow</TD></TR><TR><TD width="50%">config</TD><TD width="50%">deny</TD></TR><TR><TD width="50%">budgets</TD><TD width="50%">deny</TD></TR></TBODY></TABLE> Thu, 28 Mar 2024 09:56:29 GMT https://community.splunk.com/t5/Splunk-Search/Compare-values-in-two-different-json-objects/m-p/682252#M233090 barosan007 2024-03-28T09:56:29Z https://community.splunk.com/t5/Splunk-Search/Compare-values-in-two-different-json-objects/m-p/682254#M233091 <LI-CODE lang="markup">| spath "Action{}" output="Action" | spath "Effect" | mvexpand Action</LI-CODE> Thu, 28 Mar 2024 10:03:07 GMT https://community.splunk.com/t5/Splunk-Search/Compare-values-in-two-different-json-objects/m-p/682254#M233091 ITWhisperer 2024-03-28T10:03:07Z https://community.splunk.com/t5/Splunk-Search/Compare-values-in-two-different-json-objects/m-p/682271#M233097 <P>Finally, this worked for me.&nbsp; Thanks for advice.&nbsp;<BR /><BR /></P> <LI-CODE lang="markup">| mvexpand Json | spath "Action{}" input=Json output="Action" | spath "Effect" input=Json output="Effect" | mvexpand Action | table Action Effect</LI-CODE> Thu, 28 Mar 2024 14:06:13 GMT https://community.splunk.com/t5/Splunk-Search/Compare-values-in-two-different-json-objects/m-p/682271#M233097 barosan007 2024-03-28T14:06:13Z