How to exclude or select events based on value from key/value array?

[btsr]

Hi All,

Our JSON payload looks like as shown below. The msg.details array can have any number key/value pairs in any order.

{
  "appName": "TestApp",
  "eventType": "Response",
  "msg": {
    "transId": "Trans1234",
    "status": "Success",
    "client": "clientXyz",
    "responseTime": 1650,
    "details": [
      {
        "keyName": "returnUrl",
        "keyValue": "https://abc.com/onlineshop?prod=112&cat=1349"
      },
      {
        "keyName": "customer",
        "keyValue": "xyz"
      }
    ],
    "url": "/v1/test"
  }
}

I want to filter events using partial wildcard keyValue for a keyName in the array in the msg.details array. Your help is appreciated. Thanks.

index=* appName="TestApp" msg.url="/v1/test" |  spath | search msg.details{}.keyName=returnUrl AND msg.details{}.keyValue!="*abc.com*"

The search may include multiple keyValue filters in the array like this. Thanks.

index=* appName="TestApp" msg.url="/v1/test" |  spath | search (msg.details{}.keyName=customer AND msg.details{}.keyValue!="xyz") AND (msg.details{}.keyName=returnUrl AND msg.details{}.keyValue!="*abc.com*")

[yuanliu]

I am rather confused.  Your sample code shows exactly what you are asking.  In other words, you already have the answer.  What is missing?  If your code is not returning what you expect, you will need to illustrate the results and explain any difference between what you expect and what you receive.

Side note: Based on your search term, Splunk already extracted from JSON.  You don't need another spath.  Also, if all operators between logical terms is AND, there is no need to bracket them. Additionally, in search command, default operator is AND, so you can also omit that keyword.