Getting Data In

AND Operator in JSON

belicoff
New Member

I have a Log System which Logs in JSON Format Like these:
{
"API_Name": "Get ID Cards",
"End Point": "/write/api/v1.1/sequoiauser/idcards",
"UserID": "ABC-123",
"Response": "",
"Error": "Logos attachment retrieval Failed"
}

{
"API_Name": "Get ID Cards",
"End Point": "/write/api/v1.1/sequoiauser/idcards",
"UserID": "XYZ-123",
"Response": "{"url" : "http://some-url"}",
"Error" : null
}

Now I want to view all documents where UserID is "ABC-123" and API_Name is "Get ID Cards".
Can anyone let me know how to achieve this?
I have added KV_MODE as json.

"API_Name" : "Get ID Cards" AND "UserID" : "ABC-123" query list even the doc which has "UserID" : "XYZ-123"

0 Karma
1 Solution

alemarzu
Motivator

Hi there @belicoff

Try like this.

your search | where UserID="ABC-123" AND API_Name="Get ID Cards"

View solution in original post

0 Karma

alemarzu
Motivator

Hi there @belicoff

Try like this.

your search | where UserID="ABC-123" AND API_Name="Get ID Cards"
0 Karma

belicoff
New Member

Thanks, It Worked

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...