Splunk Search

How to concatenate fields from JSON

BeeSpark
Engager

I have an inputlookup table, in this lookup table there is a JSON array called "Evidence"

There is two field I would like to extract, one is "Rule" and the "Criticality". An example of Evidence array will look like this:

{"Evidence":[{"Rule":"Observed in the Wild Telemetry","Criticality":1},{"Rule":"Recent DDoS","Criticality":3}]}

So if I eval both "Rule" and Criticality" as shown below:

| eval "Rule"=spath(Evidence, "Evidence{}.Rule")
| eval "Criticality"=spath(Evidence, "Evidence{}.Criticality")
| table Rule Criticality

The output will show like this but the Rule & Criticality column doesn't separate into different row (it is all in one row):

Rule
Criticality
Observed in the Wild Telemetry
Recent DDoS
1
3


Now the tricky part, I would like display the top count of Rule (top Rule limit=10)  but at the same time display the associated Criticality with the Rule. How do it? since the above does not separate into different row.

The final outlook I am looking for, will look like this:

RuleCriticalityCount
Observed in the Wild Telemetry150
Recent DDoS32


An alternative I was thinking was using foreach then concate it into a Combined Field, but I think It is kind of complex.

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| spath Evidence{} output=Evidence
| mvexpand Evidence
| spath input=Evidence
| stats count by Rule Criticality

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| spath Evidence{} output=Evidence
| mvexpand Evidence
| spath input=Evidence
| stats count by Rule Criticality
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...