Splunk Search

Find first matching node of json

nainil0683
Engager

Hi,

      Based on the following json document, I want to find the value of "Geography" where City is input.

Here is the json:

 

 

 

{
    "Company" : "Microsoft",
    "Cloud" : "Azure",
    "DataCenters" : [
        {
            "Geography" : "USA",
            "Region" : "East",
            "City": "New York"
        },
        {
            "Geography" : "India",
            "Region" : "West",
            "City": "Ahmedabad"
        }, 
        {
            "Geography" : "USA",
            "Region" : "West",
            "City": "San Fransisco"
        },
        {
            "Geography" : "South Africa",
            "Region" : "West",
            "City": "Capetown"
        }
    ]
}

 

 

 

Can somebody please help me fetch this information. Thanks.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Assuming you already have a token $City_tok$ from the input, mvexpand is the most traditional way to do it

| spath path=DataCenters{}
| mvexpand DataCenters{}
| spath input=DataCenters{}
| whree City == "$City_tok$"

If mvexpand is a problem in your environment, there are other ways.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...