Splunk Search

How do I list the events if there are more than 1 item in array?

graziaedu
Explorer

how do i list the events that in an array has more than 1 item?

1) a:[ {"data1":"abc"},{"data1":"def"}]

2) a:[ {"data1":"abc"}]

3) a:[ {"data1":"abc"},{"data1":"def"}]

4) a:[ {"data1":"abc"}]

i want to list only events 1 and 3.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The first step is to find the elements in the array.  I like to use rex for that.

| rex max_match=0 "(?<element>\{[^\}]+})"

The max_match option tells rex to collect all matching strings rather than just the first.  I multi-value field will hold each match.  Next we just need to count the number of matches and filter out the singletons.

| eval elementCount = mvcount(element)
| where elementCount > 1

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

bowesmana
SplunkTrust
SplunkTrust

See this example

| makeresults 
| eval _raw="{\"a\":[ {\"data1\":\"abc\"},{\"data1\":\"def\"}]}
{\"a\":[ {\"data1\":\"abc\"}]}
{\"a\":[ {\"data1\":\"abc\"},{\"data1\":\"def\"}]}
{\"a\":[ {\"data1\":\"abc\"}]}"
| multikv noheader=t
| fields _raw 
| fields - _time
``` Above sets up your example data ```
| spath input=_raw
``` Assuming you now have validly parsed JSON - use mvcount() ```
| where mvcount('a{}.data1')>1
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...