How to avoid duplicate values in search?

[chetanN]

Hi all,

I am very new to Splunk and trying to learn it. Following is my JSON:

{
        TrainID=AA11
          TrainData: [
                                    {

                              ConnectingTrain: {
                                                                TR1: {
                                                                            connectionTime: 59
                                                                             TotalPassengers: 44
                                                                         },
                                                                    }
                                   }
                          ]

           connectionTime : 38
}

Here I want to print the value of connection time which is under TR1 and not the one that is a duplicate variable having a different value.

Appreciate any pointers here.

Thanks,

Chetan

[PickleRick]

As @gcusello said - spath is the way (or at least one of the ways) to deal with json data. One caveat though regarding jsons - Splunk's handling of json can be perceived as sub-par sometimes. Splunk doesn't handle well the "nestedness" of json data - it expects a simple "tabular" structure of your events where you simply have fields with given names and their values (possibly multiple values in one multivalued field). So it doesn't handle well such structures where you can have nested arrays of objects which contain arrays... and so on. And you have at least three different ways of dealing with json data - indexed extractions, auto-kv and manual spath, each having its pros and cons.

So for a newbie you chose a quite advanced topic 🙂

[gcusello]

Hi @chetanN,

use the spath command to extract all the fields from your data source and then choose the one you want.

<your_search>
| spath

for more infos see at https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath

Ciao.

Giuseppe