Splunk Search

How to correlate two JSON objects via a key-value pair?

Leustad
Engager

Imagine there are thousands of JSON entries and I want to correlate object pairs via a key/value pair.

Entry #44

{
    speed: 55,
    distance: 18,
    time: 1481216486,
    color: red,
}

Entry #323

{
    speed: 75,
    distance: 38,
    time: 1481216486,
    color: blue,
}

Search:

sourcetype=test_drive (DO THE MAGIC) | eval first_distance=distance(#44) | eval second_distance=distance(#323) | table time first_distance(#323) second_distance(#44)

So basically I'm trying to find an entry pair via a key/value pair and use another key/value pair from the entry pair and create a table.

Sorry for the horrible formatting. Thank you

0 Karma
1 Solution

Leustad
Engager

I found the answer below at Stack Overflow: http://stackoverflow.com/a/41109872/5415084

You want to use the transaction filter here, http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Transaction
This won't gracefully merge your json in _raw, but it will make the properties available to query/chart upon.

In this example, I assume you want to merge events by the time property, since that is the only matching field.

sourcetype=test_drive (DO THE MAGIC) | eval first_distance=distance(#44) | eval second_distance=distance(#323) | transaction time | table time first_distance(#323) second_distance(#44)

View solution in original post

0 Karma

Leustad
Engager

I found the answer below at Stack Overflow: http://stackoverflow.com/a/41109872/5415084

You want to use the transaction filter here, http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Transaction
This won't gracefully merge your json in _raw, but it will make the properties available to query/chart upon.

In this example, I assume you want to merge events by the time property, since that is the only matching field.

sourcetype=test_drive (DO THE MAGIC) | eval first_distance=distance(#44) | eval second_distance=distance(#323) | transaction time | table time first_distance(#323) second_distance(#44)
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...