Splunk Search

Extract distinct values from an response array that has partial text using RegEx

balamurugandha7
Observer

I have an array that would be presented in an API response which is being logged in Splunk and the array format is like this:

"Indicators": [
                "HAS_ACOUNT",
                "NON_ZERO_BALANCE_ACCOUNT",
                "JOINT_ACCOUNT",
                "NOT_EXPIRED",
                "REGISTERED"
            ]
 
The number of values within the array will not always have same pattern. i.e. There may be responses where there may be 10 values within 'Indicators' array.
 
Now, I want to extract distinct values within "Indicators" array (with the value that has the text "ACCOUNT") logged in Splunk for last 30 days from that specific API response. Could someone help me how to get that?
 
I wrote like this, but is didn't quite capture all possible values..

index="index_name" Env=test "........./API" | rex field=_raw "\"Indicators\"\:\[(?<planInd>[^\,]*)\]" max_match=0 | where like (planInd,"%PCP%") | dedup planInd | table planInd
Labels (3)
0 Karma

balamurugandha7
Observer

When I ran this I got the same array that is assigned to "_raw". 

What I was expecting as an output is,
"HAS_ACOUNT",
"NON_ZERO_BALANCE_ACCOUNT",
"JOINT_ACCOUNT"

as only these three values within the Indicators array has the partial text "ACCOUNT". Also I couldn't figure out in your query where exactly you are trying to extract the events that has the partial text "ACCOUNT".

For example, if there is another event that has the "Indicators" array value as follows, then I should only get the value "HAS_ACCOUNT" for this event as this is the only value within that array that has the partial text "ACCOUNT"..

"Indicators": [
          "HAS_ACOUNT",
          "NOT_EXPIRED",
]

0 Karma

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw
| eval _raw="\"Indicators\": [
                \"HAS_ACCOUNT\",
                \"NON_ZERO_BALANCE_ACCOUNT\",
                \"JOINT_ACCOUNT\",
                \"NOT_EXPIRED\",
                \"REGISTERED\"
            ]"
| rex mode=sed "s/(?ms)(.*)/{\1}/"
| spath
| rename *{} as *
| rex field=Indicators max_match=0 "(?<indicators>.*ACCOUNT)"
| table indicators
0 Karma

balamurugandha7
Observer

Please advise how am I suppose to dynamically pass values to "elav _raw...." as I am trying to apply this rex to all events logged for last 30 days.

Thanks in advance!

0 Karma

to4kawa
Ultra Champion

The rex is performed for each event, so I am not sure what the problem is.

And it doesn't say how the logs for the past 30 days will appear.

0 Karma

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw
| eval _raw="\"Indicators\": [
                \"HAS_ACOUNT\",
                \"NON_ZERO_BALANCE_ACCOUNT\",
                \"JOINT_ACCOUNT\",
                \"NOT_EXPIRED\",
                \"REGISTERED\"
            ]"
| rex mode=sed "s/(?ms)(.*)/{\1}/"
| spath

I think you will make it JSON better.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...