Splunk Search

How to exclude or select events based on value from key/value array?

btsr
Explorer

Hi All,

Our JSON payload looks like as shown below. The msg.details array can have any number key/value pairs in any order.

 

 

{
  "appName": "TestApp",
  "eventType": "Response",
  "msg": {
    "transId": "Trans1234",
    "status": "Success",
    "client": "clientXyz",
    "responseTime": 1650,
    "details": [
      {
        "keyName": "returnUrl",
        "keyValue": "https://abc.com/onlineshop?prod=112&cat=1349"
      },
      {
        "keyName": "customer",
        "keyValue": "xyz"
      }
    ],
    "url": "/v1/test"
  }
}

 

 

I want to filter events using partial wildcard keyValue for a keyName in the array in the msg.details array. Your help is appreciated. Thanks.

index=* appName="TestApp" msg.url="/v1/test" |  spath | search msg.details{}.keyName=returnUrl AND msg.details{}.keyValue!="*abc.com*"

The search may include multiple keyValue filters in the array like this. Thanks.

index=* appName="TestApp" msg.url="/v1/test" |  spath | search (msg.details{}.keyName=customer AND msg.details{}.keyValue!="xyz") AND (msg.details{}.keyName=returnUrl AND msg.details{}.keyValue!="*abc.com*")

Labels (3)
Tags (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I am rather confused.  Your sample code shows exactly what you are asking.  In other words, you already have the answer.  What is missing?  If your code is not returning what you expect, you will need to illustrate the results and explain any difference between what you expect and what you receive.

Side note: Based on your search term, Splunk already extracted from JSON.  You don't need another spath.  Also, if all operators between logical terms is AND, there is no need to bracket them. Additionally, in search command, default operator is AND, so you can also omit that keyword.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...