Splunk ITSI

ITSI Entity Object API results eval help

cdemir
Explorer

I finally figured out how to use the entity rest API object to pull my informational values.  Only problem is I can't figure out how to dynamically assign key value pairs to table from multivalue json arrays.  This is as far as I have gotten and would greatly appreciate your eyes and time:

| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/entity
fields="_key,title,identifier,informational,identifying_name" report_as=text
| eval value=spath(value,"{}")
| mvexpand value
| eval entity_title=spath(value, "title"),
entity_name=spath(value, "identifying_name"),
entity_aliases=mvzip(spath(value, "identifier.fields{}"),spath(value, "identifier.values{}"),"="),
entity_info=mvzip(spath(value, "informational.fields{}"),spath(value, "informational.values{}"),"="),
cpu_cores=spath(value, "informational.values{0}")

The second to last eval brings the informational values I want together, but as a multi-value field.  The last eval is a straight set my value to this array value eval. I would like to attempt to do that without having to hard set it for every value.  Not every entity is configured the same (I am not above clearing out my 16,000 entities and forcing standard entry by users). Dynamically creating the key value pairs as single value fields would be much more palatable instead.  

I appreciate any help at all.

Labels (2)
0 Karma
1 Solution

to4kawa
Ultra Champion
...
| eval entity_title=spath(value, "title"),
entity_name=spath(value, "identifying_name"),
entity_aliases=mvzip(spath(value, "identifier.fields{}"),spath(value, "identifier.values{}"),"="),
entity_info=mvzip(spath(value, "informational.fields{}"),spath(value, "informational.values{}"),"="),
cpu_cores=spath(value, "informational.values{0}")
| rename entity_name as _raw
| kv
| renmae entity_aliases as _raw
| kv
| rename info as _raw
| kv
| fields - _raw

A little trick.

your spath usage is nice.

View solution in original post

sandrosov_splun
Splunk Employee
Splunk Employee

Another trick that worked for me.

| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/entity report_as=text
| eval value=spath(value,"{}")
| mvexpand value
| eval info_fields=spath(value,"informational.fields{}"),
alias_fields=spath(value,"identifier.fields{}"),
entity_id=spath(value, "_key"),
entity_title=spath(value, "title"),
entity_name=spath(value, "identifying_name")
| appendpipe [ 
| mvexpand alias_fields 
| eval field_value = spath(value,alias_fields."{}"), field_type="alias" 
| rename alias_fields as field_name 
]
| appendpipe [
| where isnull(field_type)
| mvexpand info_fields 
| eval field_value = spath(value,info_fields."{}"), field_type="info"
| rename info_fields as field_name 
]
| where isnotnull(field_type)
| table entity_id entity_name entity_title field_name field_value field_type
0 Karma

to4kawa
Ultra Champion
...
| eval entity_title=spath(value, "title"),
entity_name=spath(value, "identifying_name"),
entity_aliases=mvzip(spath(value, "identifier.fields{}"),spath(value, "identifier.values{}"),"="),
entity_info=mvzip(spath(value, "informational.fields{}"),spath(value, "informational.values{}"),"="),
cpu_cores=spath(value, "informational.values{0}")
| rename entity_name as _raw
| kv
| renmae entity_aliases as _raw
| kv
| rename info as _raw
| kv
| fields - _raw

A little trick.

your spath usage is nice.

cdemir
Explorer

Oh man! That is a nifty trick. I had no idea I could do that and does exactly what I needed it to. You're awesome and thank you for the assistance.

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...