Getting Data In

Filter messages based on string in array in JSON

New Member

I am looking at filtering Kafka messages in Splunk. For that I need to be able to filter which messages show up in my search. However, since I am new to Splunk, I have no idea how to filter the way I want and 2 days of tutorials, reading and messing about haven't brought me any closer to the solution. My even data looks like this:

2020-04-01 13:59:55:803 INFO [messageCoordinator] Sent Kafka message {


Now I need to filter based on headers.deltaFields, which is always present, always a string array but can have multiple values (up to 8 strings) in the array.

I only want the event to show up in my search if certain strings are within the deltaFields. Any help would be highly appreciated.

0 Karma

index=your_index sourcetype=yours (otherString AND deltaFields)

Just search with strings

0 Karma


what's your wanted fields?

0 Karma

New Member

I only want to see the event in the search when I have headers.deltafields contains 'otherString'

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!