Splunk Search

How to avoid duplicate values in search?

chetanN
Loves-to-Learn Lots

Hi all,

I am very new to Splunk and trying to learn it. Following is my JSON:

{
        TrainID=AA11
          TrainData: [
                                    {

                              ConnectingTrain: {
                                                                TR1: {
                                                                            connectionTime: 59
                                                                             TotalPassengers: 44
                                                                         },
                                                                    }
                                   }
                          ]

           connectionTime : 38
}

Here I want to print the value of connection time which is under TR1 and not the one that is a duplicate variable having a different value.

Appreciate any pointers here.

 

Thanks,

Chetan

Labels (3)
Tags (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

As @gcusello said - spath is the way (or at least one of the ways) to deal with json data. One caveat though regarding jsons - Splunk's handling of json can be perceived as sub-par sometimes. Splunk doesn't handle well the "nestedness" of json data - it expects a simple "tabular" structure of your events where you simply have fields with given names and their values (possibly multiple values in one multivalued field). So it doesn't handle well such structures where you can have nested arrays of objects which contain arrays... and so on. And you have at least three different ways of dealing with json data - indexed extractions, auto-kv and manual spath, each having its pros and cons.

So for a newbie you chose a quite advanced topic 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @chetanN,

use the spath command to extract all the fields from your data source and then choose the one you want.

<your_search>
| spath

for more infos see at https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...