Splunk ITSI

ITSI Entity Object API results eval help

cdemir
Explorer

I finally figured out how to use the entity rest API object to pull my informational values.  Only problem is I can't figure out how to dynamically assign key value pairs to table from multivalue json arrays.  This is as far as I have gotten and would greatly appreciate your eyes and time:

| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/entity
fields="_key,title,identifier,informational,identifying_name" report_as=text
| eval value=spath(value,"{}")
| mvexpand value
| eval entity_title=spath(value, "title"),
entity_name=spath(value, "identifying_name"),
entity_aliases=mvzip(spath(value, "identifier.fields{}"),spath(value, "identifier.values{}"),"="),
entity_info=mvzip(spath(value, "informational.fields{}"),spath(value, "informational.values{}"),"="),
cpu_cores=spath(value, "informational.values{0}")

The second to last eval brings the informational values I want together, but as a multi-value field.  The last eval is a straight set my value to this array value eval. I would like to attempt to do that without having to hard set it for every value.  Not every entity is configured the same (I am not above clearing out my 16,000 entities and forcing standard entry by users). Dynamically creating the key value pairs as single value fields would be much more palatable instead.  

I appreciate any help at all.

Labels (2)
0 Karma
1 Solution

to4kawa
Ultra Champion
...
| eval entity_title=spath(value, "title"),
entity_name=spath(value, "identifying_name"),
entity_aliases=mvzip(spath(value, "identifier.fields{}"),spath(value, "identifier.values{}"),"="),
entity_info=mvzip(spath(value, "informational.fields{}"),spath(value, "informational.values{}"),"="),
cpu_cores=spath(value, "informational.values{0}")
| rename entity_name as _raw
| kv
| renmae entity_aliases as _raw
| kv
| rename info as _raw
| kv
| fields - _raw

A little trick.

your spath usage is nice.

View solution in original post

sandrosov_splun
Splunk Employee
Splunk Employee

Another trick that worked for me.

| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/entity report_as=text
| eval value=spath(value,"{}")
| mvexpand value
| eval info_fields=spath(value,"informational.fields{}"),
alias_fields=spath(value,"identifier.fields{}"),
entity_id=spath(value, "_key"),
entity_title=spath(value, "title"),
entity_name=spath(value, "identifying_name")
| appendpipe [ 
| mvexpand alias_fields 
| eval field_value = spath(value,alias_fields."{}"), field_type="alias" 
| rename alias_fields as field_name 
]
| appendpipe [
| where isnull(field_type)
| mvexpand info_fields 
| eval field_value = spath(value,info_fields."{}"), field_type="info"
| rename info_fields as field_name 
]
| where isnotnull(field_type)
| table entity_id entity_name entity_title field_name field_value field_type
0 Karma

to4kawa
Ultra Champion
...
| eval entity_title=spath(value, "title"),
entity_name=spath(value, "identifying_name"),
entity_aliases=mvzip(spath(value, "identifier.fields{}"),spath(value, "identifier.values{}"),"="),
entity_info=mvzip(spath(value, "informational.fields{}"),spath(value, "informational.values{}"),"="),
cpu_cores=spath(value, "informational.values{0}")
| rename entity_name as _raw
| kv
| renmae entity_aliases as _raw
| kv
| rename info as _raw
| kv
| fields - _raw

A little trick.

your spath usage is nice.

cdemir
Explorer

Oh man! That is a nifty trick. I had no idea I could do that and does exactly what I needed it to. You're awesome and thank you for the assistance.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...