Splunk Search

How do I find events that have a specific value in an array of JSON strings?

cpomerantzuniso
New Member

I have a JSON object that includes a field that is an array of strings. So something like this:

{
  "tags": [
    "value1",
    "value2"
  ]
}

I want to find all of the events that contain a specific value like "value2". I tried using mvfind but that didn't seem to work, something like this:

index="logs" | where isnotnull(mvfind(tags, "value2"))

Can someone tell me how I can do this?

Thanks!

0 Karma

harsmarvania57
Ultra Champion

Hi @cpomerantzunison,

Please try below query (Here I am assuming that JSON data is already parsed and you have field called tags{})

index="logs" 
| rename tags{} AS tagvalue
| where (tagvalue LIKE "value2")

Below is run anywhere search which you can run on any splunk instance and check the output.

| makeresults
| eval field1="{
  \"tags\": [
    \"value1\",
    \"value2\"
  ]
}"
| append [ makeresults
| eval field1="{
  \"tags\": [
    \"value1\",
    \"value3\"
  ]
}" ]
| spath input=field1
| rename tags{} AS test_tag
| where (test_tag LIKE "value2")
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...