Request for Splunk Query to Extract Names from Accessible_by Arrays

[Tajuddin]

I am reaching out to request assistance with building a Splunk query that can extract names from the accessible_by arrays in the log data and present them in a single row.

I would like a Splunk query that extracts these names and displays them in a single row with the field accessible_by.name. The expected output is

accessible_by.name

Pradeep Tallam Lakshmi Prasanna Lakamsani

Here is an example of the log message format:

message: {BOX CM FPN EVENT requestBody {"channel_id":"","event_type":"COLLAB_INVITE_COLLABORATOR","event_id":"11889593183610133","created_at":"2024-08-01T06:16:28-07:00","created_by":{"type":"user","id":"21066233551","name":"Sk Tajuddin","login":"[email protected]"},"source":{"type":"folder","id":"259179951858","sequence_id":"0","etag":"0","name":"My recordings","created_at":"2024-04-16T07:25:18-07:00","modified_at":"2024-05-15T13:53:17-07:00","description":"","size":20180208521,"path_collection":{"total_count":0,"entries":[]},"created_by":{"type":"user","id":"21066233551","name":"Sk Tajuddin","login":"[email protected]"},"modified_by":{"type":"user","id":"21066233551","name":"Sk Tajuddin","login":"[email protected]"},"trashed_at":null,"purged_at":null,"content_created_at":"2024-04-16T07:25:18-07:00","content_modified_at":"2024-05-15T13:53:17-07:00","owned_by":{"type":"user","id":"21066233551","name":"Sk Tajuddin","login":"[email protected]"},"shared_link":null,"folder_upload_email":null,"parent":{"type":"folder","id":"0","sequence_id":null,"etag":null,"name":"All Files"},"item_status":"active","item_collection":{"total_count":5,"entries":[{"type":"file","id":"1516571855910","file_version":{"type":"file_version","id":"1665332707110","sha1":"840bac4b4aeba16ca41c7b7a0b7288a9fd6aecac"},"sequence_id":"0","etag":"0","sha1":"840bac4b4aeba16ca41c7b7a0b7288a9fd6aecac","name":"Chorus deployment part 1.mov"},{"type":"file","id":"1516571257880","file_version":{"type":"file_version","id":"1665332512280","sha1":"0f4147580b7b7b7cde0036124fdda1738f9c1b92"},"sequence_id":"0","etag":"0","sha1":"0f4147580b7b7b7cde0036124fdda1738f9c1b92","name":"Chorus Deployment part 2.mov"},{"type":"file","id":"1516586947142","file_version":{"type":"file_version","id":"1665349857542","sha1":"b953ffaa99b32b66e0a5f607205a5116c0aadc1e"},"sequence_id":"0","etag":"0","sha1":"b953ffaa99b32b66e0a5f607205a5116c0aadc1e","name":"Deployment process of Oomnitza Certs for Retail and AC CR.mov"},{"type":"file","id":"1503788446950","file_version":{"type":"file_version","id":"1651069594950","sha1":"63b30177d283bf8061b7ad4d9712882829950f77"},"sequence_id":"1","etag":"1","sha1":"63b30177d283bf8061b7ad4d9712882829950f77","name":"Roomlookup job deployment.mov"},{"type":"file","id":"1531717232578","file_version":{"type":"file_version","id":"1682330389378","sha1":"f4f0fc6473ce24ef66635ca8d8ff410b734c95a1"},"sequence_id":"0","etag":"0","sha1":"f4f0fc6473ce24ef66635ca8d8ff410b734c95a1","name":"Slack Rooms App weekly deployment.mov"}],"offset":0,"limit":100,"order":[{"by":"type","direction":"ASC"},{"by":"name","direction":"ASC"}]},"collaborators":{"next_marker":"","previous_marker":"","entries":[{"type":"collaboration","id":"55749534901","created_by":{"type":"user","id":"21066233551","name":"Sk Tajuddin","login":"[email protected]"},"created_at":"2024-08-01T06:16:27-07:00","modified_at":"2024-08-01T06:16:27-07:00","expires_at":null,"status":"pending","accessible_by":null,"invite_email":"[email protected]","role":"editor","acknowledged_at":null,"item":{"type":"folder","id":"259179951858","sequence_id":"0","etag":"0","name":"My recordings"}},{"type":"collaboration","id":"53612889578","created_by":{"type":"user","id":"21066233551","name":"Sk Tajuddin","login":"[email protected]"},"created_at":"2024-04-28T23:34:46-07:00","modified_at":"2024-04-28T23:34:46-07:00","expires_at":null,"status":"accepted","accessible_by":{"type":"user","id":"9049454819","name":"Pradeep Tallam","login":"[email protected]","is_active":true},"invite_email":null,"role":"editor","acknowledged_at":"2024-04-28T23:34:46-07:00","item":{"type":"folder","id":"259179951858","sequence_id":"0","etag":"0","name":"My recordings"}},{"type":"collaboration","id":"53611885725","created_by":{"type":"user","id":"21066233551","name":"Sk Tajuddin","login":"[email protected]"},"created_at":"2024-04-28T23:40:15-07:00","modified_at":"2024-04-28T23:40:15-07:00","expires_at":null,"status":"accepted","accessible_by":{"type":"user","id":"20437795550","name":"Lakshmi Prasanna Lakamsani","login":"[email protected]","is_active":true},"invite_email":null,"role":"editor","acknowledged_at":"2024-04-28T23:40:15-07:00","item":{"type":"folder","id":"259179951858","sequence_id":"0","etag":"0","name":"My recordings"}}]}}}}

Could you please assist in creating this query?

[Tajuddin]

Hi @ITWhisperer Thanks for assisting in this matter. One additional request is Can i search from the json data/ request body as source.name=“My Recordings” and tabulate theaccessible_by.name. Please help me the splunk query. Thanks in Advance

[ITWhisperer · Accepted solution]

| rex "requestBody (?<requestBody>\{.*\})$"
| spath input=requestBody source.collaborators.entries{}.accessible_by.name output=accessible_by.name
| spath input=requestBody source.name
| where 'source.name'="My recordings"

[ITWhisperer]

| rex "requestBody (?<requestBody>\{.*\})$"
| spath input=requestBody source.collaborators.entries{}.accessible_by.name output=accessible_by.name