topic Re: How to correlate two JSON objects via a key-value pair? in Splunk Search

How to correlate two JSON objects via a key-value pair?

Leustad — Thu, 08 Dec 2016 17:10:23 GMT

Imagine there are thousands of JSON entries and I want to correlate object pairs via a key/value pair.

Entry #44

{
    speed: 55,
    distance: 18,
    time: 1481216486,
    color: red,
}

Entry #323

{
    speed: 75,
    distance: 38,
    time: 1481216486,
    color: blue,
}

Search:

sourcetype=test_drive (DO THE MAGIC) | eval first_distance=distance(#44) | eval second_distance=distance(#323) | table time first_distance(#323) second_distance(#44)

So basically I'm trying to find an entry pair via a key/value pair and use another key/value pair from the entry pair and create a table.

Sorry for the horrible formatting. Thank you

Re: How to correlate two JSON objects via a key-value pair?

Leustad — Mon, 12 Dec 2016 21:29:30 GMT

I found the answer below at Stack Overflow: http://stackoverflow.com/a/41109872/5415084

You want to use the transaction filter here, http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Transaction
This won't gracefully merge your json in _raw, but it will make the properties available to query/chart upon.

In this example, I assume you want to merge events by the time property, since that is the only matching field.

sourcetype=test_drive (DO THE MAGIC) | eval first_distance=distance(#44) | eval second_distance=distance(#323) | transaction time | table time first_distance(#323) second_distance(#44)