Splunk IT Service Intelligence

ITSI Entity Object API results eval help

cdemir
Explorer

I finally figured out how to use the entity rest API object to pull my informational values.  Only problem is I can't figure out how to dynamically assign key value pairs to table from multivalue json arrays.  This is as far as I have gotten and would greatly appreciate your eyes and time:

| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/entity
fields="_key,title,identifier,informational,identifying_name" report_as=text
| eval value=spath(value,"{}")
| mvexpand value
| eval entity_title=spath(value, "title"),
entity_name=spath(value, "identifying_name"),
entity_aliases=mvzip(spath(value, "identifier.fields{}"),spath(value, "identifier.values{}"),"="),
entity_info=mvzip(spath(value, "informational.fields{}"),spath(value, "informational.values{}"),"="),
cpu_cores=spath(value, "informational.values{0}")

The second to last eval brings the informational values I want together, but as a multi-value field.  The last eval is a straight set my value to this array value eval. I would like to attempt to do that without having to hard set it for every value.  Not every entity is configured the same (I am not above clearing out my 16,000 entities and forcing standard entry by users). Dynamically creating the key value pairs as single value fields would be much more palatable instead.  

I appreciate any help at all.

Labels (2)
0 Karma
1 Solution

to4kawa
SplunkTrust
SplunkTrust
...
| eval entity_title=spath(value, "title"),
entity_name=spath(value, "identifying_name"),
entity_aliases=mvzip(spath(value, "identifier.fields{}"),spath(value, "identifier.values{}"),"="),
entity_info=mvzip(spath(value, "informational.fields{}"),spath(value, "informational.values{}"),"="),
cpu_cores=spath(value, "informational.values{0}")
| rename entity_name as _raw
| kv
| renmae entity_aliases as _raw
| kv
| rename info as _raw
| kv
| fields - _raw

A little trick.

your spath usage is nice.

View solution in original post

sandrosov_splun
Splunk Employee
Splunk Employee

Another trick that worked for me.

| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/entity report_as=text
| eval value=spath(value,"{}")
| mvexpand value
| eval info_fields=spath(value,"informational.fields{}"),
alias_fields=spath(value,"identifier.fields{}"),
entity_id=spath(value, "_key"),
entity_title=spath(value, "title"),
entity_name=spath(value, "identifying_name")
| appendpipe [ 
| mvexpand alias_fields 
| eval field_value = spath(value,alias_fields."{}"), field_type="alias" 
| rename alias_fields as field_name 
]
| appendpipe [
| where isnull(field_type)
| mvexpand info_fields 
| eval field_value = spath(value,info_fields."{}"), field_type="info"
| rename info_fields as field_name 
]
| where isnotnull(field_type)
| table entity_id entity_name entity_title field_name field_value field_type
0 Karma

to4kawa
SplunkTrust
SplunkTrust
...
| eval entity_title=spath(value, "title"),
entity_name=spath(value, "identifying_name"),
entity_aliases=mvzip(spath(value, "identifier.fields{}"),spath(value, "identifier.values{}"),"="),
entity_info=mvzip(spath(value, "informational.fields{}"),spath(value, "informational.values{}"),"="),
cpu_cores=spath(value, "informational.values{0}")
| rename entity_name as _raw
| kv
| renmae entity_aliases as _raw
| kv
| rename info as _raw
| kv
| fields - _raw

A little trick.

your spath usage is nice.

View solution in original post

cdemir
Explorer

Oh man! That is a nifty trick. I had no idea I could do that and does exactly what I needed it to. You're awesome and thank you for the assistance.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!