Splunk Search

How to correlate two JSON objects via a key-value pair?

Leustad
Engager

Imagine there are thousands of JSON entries and I want to correlate object pairs via a key/value pair.

Entry #44

{
    speed: 55,
    distance: 18,
    time: 1481216486,
    color: red,
}

Entry #323

{
    speed: 75,
    distance: 38,
    time: 1481216486,
    color: blue,
}

Search:

sourcetype=test_drive (DO THE MAGIC) | eval first_distance=distance(#44) | eval second_distance=distance(#323) | table time first_distance(#323) second_distance(#44)

So basically I'm trying to find an entry pair via a key/value pair and use another key/value pair from the entry pair and create a table.

Sorry for the horrible formatting. Thank you

0 Karma
1 Solution

Leustad
Engager

I found the answer below at Stack Overflow: http://stackoverflow.com/a/41109872/5415084

You want to use the transaction filter here, http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Transaction
This won't gracefully merge your json in _raw, but it will make the properties available to query/chart upon.

In this example, I assume you want to merge events by the time property, since that is the only matching field.

sourcetype=test_drive (DO THE MAGIC) | eval first_distance=distance(#44) | eval second_distance=distance(#323) | transaction time | table time first_distance(#323) second_distance(#44)

View solution in original post

0 Karma

Leustad
Engager

I found the answer below at Stack Overflow: http://stackoverflow.com/a/41109872/5415084

You want to use the transaction filter here, http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Transaction
This won't gracefully merge your json in _raw, but it will make the properties available to query/chart upon.

In this example, I assume you want to merge events by the time property, since that is the only matching field.

sourcetype=test_drive (DO THE MAGIC) | eval first_distance=distance(#44) | eval second_distance=distance(#323) | transaction time | table time first_distance(#323) second_distance(#44)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...