Hello,
I want to extract a multivalued field in a nested JSON event
A: [
{ [-]
file: x
type:a
}
{ [-]
file: y
type:b
}
]
Here in the above JSON, i want to extract the field named 'file' if and only if the type = 'a' and not 'b'.
Inside props.conf, I specified a condition as mentioned :
EVAL-myfile= if('type'=="a",'file', "")
The problem here is, it will extract even the file where type='b' as they belong to the same event.
Is there a way in props.conf to correctly evaluate the file attribute in this nested JSON ?
Also I need to map this field for Splunk CIM data Model so I can not do this in the search query of dashboards.
Like this (assuming that you are using INDEXED_EXTRACTIONS = json
😞
EVAL-myfile = mvindex(file, mvfind(type, "a"))
No we are not using INDEXED_EXTRACTIONS = json
Then there are no indexed fields to use at index-time so it is impossible.