Best tool in the toolkit to access and correlate multivalue fields

[ft_kd02]

Hi all, 

I've worked with multivalue fields in a limited capacity and I'm having trouble with a particular instance. Generally, multivalue fields I've worked have been small or had static indexing, such that I could use mvindexing or simple renaming to extract the value I needed. I've run across a situation in which I have a JSON array called 'tokenData' that is dynamically populated with smaller arrays of metadata such that the index is not static. 

Example:

There will be hundreds of these in the array in a single splunk event. What I need to do is access these fields and extract the tokenData where the tokenId is a specific value, and compare that with other elements of the search. 

Example: 

tokenId: 105
tokenLength:70
tokenData: blahblah

I need to extract this into a field and check it's value within the context of an alert. There will be some processing of the actual field as well, but that should be easy if I can get the value, correlated with the ID. 

Things I know: tokenId needed will always be static, tokenLength of said tokenId will always be static, tokenData will change depending on the situation. 

What is the best way to get this value consistently, when the array is not static? I'd need the value of the field tokenData wherever tokenId=target. Hope this was clear.

Thanks

[yuanliu]

You did not show the top level nodes. (And it's always a bad idea to use screenshots to show data; use raw text.)

If your upper array node is indeed called tokenData, Splunk should have something like tokenData{}.tokenData, tokenData{}.tokenId, etc.  To spread them out, first reach to that array with spath.  That will convert the JSON array to ordinary multivalue tokenData{} so you can use mvexpand.  Lastly, use spath again with each element to extract single value tokenData, tokenId.

| spath path=tokenData{}
| mvexpand tokenData{}
| spath input=tokenData{}

Hope this helps.