Splunk AppDynamics

Data collection and getter chain query

Sonu_Sunny
New Member

Scenario :123 [abc xyz  11111 ]

I want to create a getter chain to collect the data in the middle of an array (xyz) where abc and xyz are dynamic . Could anyone help me to get the right getter chain to capture data in analytics.

toString().split(123\\\ [).[1].xxx

Labels (3)
0 Karma

Morelz
Motivator

Hi Sonu

1. Can you advise if the value after xyz is always the same? In your example 11111

2. Can you advise if abc and xyz are always certain length long, e.g 3 characters, integers or does it vary?

Ciao

0 Karma

Sonu_Sunny
New Member

Hi, @Mario.Morelli 

All data is dynamic and length also will vary.

0 Karma

Morelz
Motivator

Hi Sonu

Is it possible to share a sample of a payload? Just replace sensitive information

Ciao

Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...