Getting Data In

AND Operator in JSON

belicoff
New Member

I have a Log System which Logs in JSON Format Like these:
{
"API_Name": "Get ID Cards",
"End Point": "/write/api/v1.1/sequoiauser/idcards",
"UserID": "ABC-123",
"Response": "",
"Error": "Logos attachment retrieval Failed"
}

{
"API_Name": "Get ID Cards",
"End Point": "/write/api/v1.1/sequoiauser/idcards",
"UserID": "XYZ-123",
"Response": "{"url" : "http://some-url"}",
"Error" : null
}

Now I want to view all documents where UserID is "ABC-123" and API_Name is "Get ID Cards".
Can anyone let me know how to achieve this?
I have added KV_MODE as json.

"API_Name" : "Get ID Cards" AND "UserID" : "ABC-123" query list even the doc which has "UserID" : "XYZ-123"

0 Karma
1 Solution

alemarzu
Motivator

Hi there @belicoff

Try like this.

your search | where UserID="ABC-123" AND API_Name="Get ID Cards"

View solution in original post

0 Karma

alemarzu
Motivator

Hi there @belicoff

Try like this.

your search | where UserID="ABC-123" AND API_Name="Get ID Cards"
0 Karma

belicoff
New Member

Thanks, It Worked

0 Karma
Get Updates on the Splunk Community!

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...