Getting Data In

How to dedup a field inside JSON arrays?

jravida
Communicator

Hi guys,

I'm working on some formulas to show percentages, right now trying to count % vendors affected by vulnerabilities. The data I am working with is a single JSON file, broken down into each Vulnerability ID. Problem is, if I try to dedup a Vendor that is affected by a particular vulnerability (which are listed as vendor, product, version, inside separate JSON sub-arrays within the vulnerability ID), it still counts the multiple versions, even though I:

index = jsonvuln | dedup id Vendor | top 100 Vendor

returns > 100% for Vendors like Apple and Adobe, which show up multiple times in each Vulnerability ID. So like 236.76% for Adobe.The dedup doesn't seem to work for the array within the event. Is there a command I can use to dedup these Vendors so Splunk only counts it once?

Tags (2)
0 Karma
1 Solution

jravida
Communicator

Figured it out.

I have to use mvexpand on the Vendor field. Then dedup Vendor and ID fields. So simple!

View solution in original post

0 Karma

jravida
Communicator

Figured it out.

I have to use mvexpand on the Vendor field. Then dedup Vendor and ID fields. So simple!

View solution in original post

0 Karma