Knowledge Management

How to filter a field with multiple values for a key via collection.data.query?

smitapatankar
Engager

I am able to fetch data using filter as query=json.dumps({'status': 'Fixed'})
But, am not able to filter data for multiple values.
Its either giving data for only one of the two values or not giving data at all or giving some kind of an error.
I want to do something like query=json.dumps({'status': ['Fixed', 'New']})

code:

import json
import splunklib.client as client
service = client.connect(
host='xxxx', port=xxxx, username='xxxx', password='xxxxx', owner='xxxxx', app='xxxx')
collection = service.kvstore['xxxx']
response = collection.data.query(********) --> pass a query here
print(response)

0 Karma

YassirLaaroussi
Observer

Hello,
You can use the "$or" or "$and" operator in your json query, here is an example that worked for me:

query = json.dumps({"$or":[{"id": "X354" },{"id":"Y762"}]})
data = collection.data.query(query =query) 

Ressources : https://docs.splunk.com/Documentation/Splunk/8.0.4/RESTREF/RESTkvstore

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...