Getting Data In

Dropping blank paths in a JSON search

brutecat
Path Finder

Hi,

I am doing some experimentation wirh regards JSON events. I have two events loaded:

{
"event":
{
"time": "2019-02-10T05:52:03",
"StatsMonitor": {
"time": "2019-02-10T05:52:03",
"name": "StatsMonitor",
"LocalTimetDelta": 0,
"CaptureTimetDelta": 0,
"DeltaTimeAuditLog": 0,
"ActiveUsers": 26
}
}

}

and

{
"action":
{
"StatsMonitor": {
"time": "2019-02-10T05:52:03",
"name": "StatsMonitor",
"LocalTimetDelta": 0,
"CaptureTimetDelta": 0,
"DeltaTimeAuditLog": 0,
"ActiveUsers": 26
}
}
,
"action":
{
"StatsMonitorx": {
"time": "2019-01-10T06:52:03",
"name": "StatsMonitor",
"LocalTimetDelta": 0,
"CaptureTimetDelta": 0,
"DeltaTimeAuditLog": 0,
"ActiveUsers": 52
}
}

}

The index I am using is 'conship'

I have a search:

index=conship | spath
path=event.StatsMonitor
| rename event.time as time, event.StatsMonitor.* as *
| table time ActiveUsers

which is returning both events as results, but has duplicate data coming from the first (which is the correct data).

I would have thought:

spath path=event.StatsMonitor

would have eliminated the data altogether from the second event. Perhaps I could get a blank line, but why am I getting a duplicate from the correct event.

Thanks,

Stan

Tags (3)
0 Karma

poete
Builder

Hello @brutecat,

the bellow does the trick

| makeresults 
| eval _raw="{
          \"event\":
                 {
                 \"time\": \"2019-02-10T05:52:03\",
                  \"StatsMonitor\": {
                          \"time\": \"2019-02-10T05:52:03\",
                          \"name\": \"StatsMonitor\",
                          \"LocalTimetDelta\": 0,
                          \"CaptureTimetDelta\": 0,
                          \"DeltaTimeAuditLog\": 0,
                          \"ActiveUsers\": 26
                     }
                 },
          \"action\":
                 {
                      \"StatsMonitor\": {
                          \"time\": \"2019-02-10T05:52:03\",
                          \"name\": \"StatsMonitor\",
                          \"LocalTimetDelta\": 0,
                          \"CaptureTimetDelta\": 0,
                          \"DeltaTimeAuditLog\": 0,
                          \"ActiveUsers\": 26
                     }
                 }
                 ,
         \"action\":
                 {
                      \"StatsMonitor\": {
                          \"time\": \"2019-01-10T06:52:03\",
                          \"name\": \"StatsMonitor\",
                          \"LocalTimetDelta\": 0,
                          \"CaptureTimetDelta\": 0,
                          \"DeltaTimeAuditLog\": 0,
                          \"ActiveUsers\": 52
                     }
                 }

     }"
| spath
| rename event.time as time
| spath path=event
| rename event.StatsMonitor.* as *
| table time ActiveUsers
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@brutecat

Can you please share sample events using precode block (101010 in text editor) ?

0 Karma

brutecat
Path Finder
    {
         "event":
                {
                "time": "2019-02-10T05:52:03",
                 "StatsMonitor": {
                         "time": "2019-02-10T05:52:03",
                         "name": "StatsMonitor",
                         "LocalTimetDelta": 0,
                         "CaptureTimetDelta": 0,
                         "DeltaTimeAuditLog": 0,
                         "ActiveUsers": 26
                    }
                }


    }

AND
    {
         "action":
                {
                     "StatsMonitor": {
                         "time": "2019-02-10T05:52:03",
                         "name": "StatsMonitor",
                         "LocalTimetDelta": 0,
                         "CaptureTimetDelta": 0,
                         "DeltaTimeAuditLog": 0,
                         "ActiveUsers": 26
                    }
                }
                ,
        "action":
                {
                     "StatsMonitorx": {
                         "time": "2019-01-10T06:52:03",
                         "name": "StatsMonitor",
                         "LocalTimetDelta": 0,
                         "CaptureTimetDelta": 0,
                         "DeltaTimeAuditLog": 0,
                         "ActiveUsers": 52
                    }
                }


    }
0 Karma

brutecat
Path Finder

Sorry - I realise the search was also cobbled. The asterisk was dropped:

index=conship | spath 
path=event.StatsMonitor
| rename event.time as time, event.StatsMonitor.* as *
| table time ActiveUsers
0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...