Splunk Search

How achieve a conjunction (AND operator) in a JSON nested Key-value(KV) array

T0n1g3
New Member

Event Data:
{"Debug":[
  {"Action":"User-Created","Result":"OK"},
  {"Action":"Granted-Permissions","Result":"Failed"}
]}

My try:
# Get the events where Action equal "User-Created" and Result="Failed"
Search: index=index_name Debug{}.Action="User-Created" AND Debug{}.Result="Failed"

Expected:
No records should be returned because there are not a single record where the two values are true.

Result:
Multiple records returned, conjunction is not being performed, it operates like an OR logical function.

Notes:
It works if I choose simple not KV data.

Thanks,

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The filter on the search is returning events that have both strings. Both strings appear in your event.

You either have to include the whole string (escaping double quotes as necessary) "\"User-Created\",\"Result\":\"Failed\"" or you have to mvexpand (or similar) the Debug array into separate events and then filter those events.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...