Splunk Search

Can I index into array in my search to pull two specific displayName and result values out and use stats command?

meliaolsen
New Member

Hello folks,

I'm trying to write a drill-down search for a correlation search in Enterprise Security, and I'm having trouble extracting/accessing a field in my event. Each event has a collection of conditional access policies stored in an array, with each value in the array being a collection of key-value pairs. With syntax highlighted, it looks like this (with some policies not expanded): 

meliaolsen_0-1656523986715.png

Here's what it looks like in the raw text: 

 

 

 

"appliedConditionalAccessPolicies": [{"id": "xxx", "displayName": "xxx", "enforcedGrantControls": [], "enforcedSessionControls": [], "result": "notEnabled"}, {"id": "xxx", "displayName": "xxx", "enforcedGrantControls": ["Mfa"], "enforcedSessionControls": ["CloudAppSecurity"], "result": "notApplied"}, {"id": "xxx", "displayName": "xxx", "enforcedGrantControls": ["RequireApprovedApp"], "enforcedSessionControls": [], "result": "notApplied"}, ...]

 

 

 

 

We've extracted the fields:

  • appliedConditionalAccessPolicies{}.displayName
  • appliedConditionalAccessPolicies{}.enforcedGrantControls
  • appliedConditionalAccessPolicies{}.enforcedSessionControls
  • appliedConditionalAccessPolicies{}.id
  • appliedConditionalAccessPolicies{}.result

However, because we have 13 different policies in the appliedConditionalAccessPolicies array, every event contains every possible value of each of these fields. We don't have a way to associate values from the same index of the array together. Many of these policies are tests, which I don't care about. I really only care about two of them, and I would like to find a way to access at least the displayName and result of only those two policies. It would also be nice to access the enforcedGrantControls and enforcedSessionControls of the policies, but those are less critical to my search.

Is there a way I can index into this array in my search to pull two specific displayName and result values out and use them, for example with a stats command?

Thanks in advance for your help!

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try extracting the array objects, then use mvexpand to create separate event, then extract the part of the object you want

| spath appliedConditionalAccessPolicies{} output=appliedConditionalAccessPolicies
| mvexpand appliedConditionalAccessPolicies
| spath input=appliedConditionalAccessPolicies displayName
| spath input=appliedConditionalAccessPolicies enforcedGrantControls{}
| spath input=appliedConditionalAccessPolicies enforcedSessionControls{}
| spath input=appliedConditionalAccessPolicies id
| spath input=appliedConditionalAccessPolicies result
0 Karma

meliaolsen
New Member

Thanks for your response!

I've tried implementing your suggestion, but I'm still not fully understanding how mvexpand and spath work. (I'm relatively new to SPL.) Where do the array objects and new events go after I've extracted them?

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...