Splunk Search

How to extract info from nested data with specific parameter?

paulito
Explorer

Aternity Extraction.png

 

I need to extract the Activity Score and Application UXI Average but only when the Application Name is a certain name. 

It's a weird one for me because of the way data comes in. As you can see each event has multiple application names, activity scores, uxi averages and timeframes. So even when I specify for a certain app in a search, since the app name is in an event, I get the whole event which includes all the other apps and metrics.

I hope what I'm explaining is clear and any help would be appreciated. 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| spath value{} output=value
| mvexpand value
| spath input=value
| where APPLICATION_NAME="certain app"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| spath value{} output=value
| mvexpand value
| spath input=value
| where APPLICATION_NAME="certain app"

paulito
Explorer

Works perfectly, thank you!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...

55 Days to Go: Secure Your Seat at Splunk University in Denver

Your .conf26 Experience Starts Before Opening Keynote  If Denver is known for its mile-high elevation, Splunk ...

(re)Introducing the Splunk Community Champions + 2026 – 2027 Splunk MVPs ...

This program exists as a channel to empower and recognize Splunk advocates and help supercharge initiatives to ...