Splunk Search

How to extract info from nested data with specific parameter?

paulito
Explorer

Aternity Extraction.png

 

I need to extract the Activity Score and Application UXI Average but only when the Application Name is a certain name. 

It's a weird one for me because of the way data comes in. As you can see each event has multiple application names, activity scores, uxi averages and timeframes. So even when I specify for a certain app in a search, since the app name is in an event, I get the whole event which includes all the other apps and metrics.

I hope what I'm explaining is clear and any help would be appreciated. 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| spath value{} output=value
| mvexpand value
| spath input=value
| where APPLICATION_NAME="certain app"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| spath value{} output=value
| mvexpand value
| spath input=value
| where APPLICATION_NAME="certain app"

paulito
Explorer

Works perfectly, thank you!

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...