Splunk Search

How achieve a conjunction (AND operator) in a JSON nested Key-value(KV) array

T0n1g3
New Member

Event Data:
{"Debug":[
  {"Action":"User-Created","Result":"OK"},
  {"Action":"Granted-Permissions","Result":"Failed"}
]}

My try:
# Get the events where Action equal "User-Created" and Result="Failed"
Search: index=index_name Debug{}.Action="User-Created" AND Debug{}.Result="Failed"

Expected:
No records should be returned because there are not a single record where the two values are true.

Result:
Multiple records returned, conjunction is not being performed, it operates like an OR logical function.

Notes:
It works if I choose simple not KV data.

Thanks,

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The filter on the search is returning events that have both strings. Both strings appear in your event.

You either have to include the whole string (escaping double quotes as necessary) "\"User-Created\",\"Result\":\"Failed\"" or you have to mvexpand (or similar) the Debug array into separate events and then filter those events.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...