Hi Everyone,
I've heard many times that it is challenging to get ITSI entities list with a proper alias and informational fields mapping in ITSI. A circulating SPL query is mixing types of the fields and does not fully solves the issue.
Please check out this SPL script I have created for getting the right dataset.
| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/entity report_as=text
| eval value=spath(value,"{}")
| mvexpand value
| eval info_fields=spath(value,"informational.fields{}"),
alias_fields=spath(value,"identifier.fields{}"),
entity_id=spath(value, "_key"),
entity_title=spath(value, "title"),
entity_name=spath(value, "identifying_name")
| appendpipe [
| mvexpand alias_fields
| eval field_value = spath(value,alias_fields."{}"), field_type="alias"
| rename alias_fields as field_name
]
| appendpipe [
| where isnull(field_type)
| mvexpand info_fields
| eval field_value = spath(value,info_fields."{}"), field_type="info"
| rename info_fields as field_name
]
| where isnotnull(field_type)
| table entity_id entity_name entity_title field_name field_value field_type
