Splunk Search

How to compare two json objects for equality?

rmullin
Loves-to-Learn Lots

I have a table where the x axis labels are a json object of parameters that were passed into a test. The y axis are a bar chart of min, max, and average durations per parameters. I have a drilldown that passes the x axis label into a lower chart that can view each individual duration of a specific test given the parameters. The search result comes out as something like this:

```

eventtype="my_event_type"  header.run_id="my_run_id" header.type="type_of_test" payload.parameters="{"some": "json", "blob": "with", "date": "the", "parameters": "defined"}"
| mvexpand durations
| table ...

```

Splunk doesn't seem to play nice with comparing objects for equality, and I can't compare the fields directly because given the test type I don't know what the parame

Labels (1)
0 Karma

rmullin
Loves-to-Learn Lots

message got cutoff prematurely. I can't compare each field individually because I don't know what the shape of the parameters are, they change depending on what the test type is

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...