Splunk Search

How to extract info from nested data with specific parameter?

paulito
Explorer

Aternity Extraction.png

 

I need to extract the Activity Score and Application UXI Average but only when the Application Name is a certain name. 

It's a weird one for me because of the way data comes in. As you can see each event has multiple application names, activity scores, uxi averages and timeframes. So even when I specify for a certain app in a search, since the app name is in an event, I get the whole event which includes all the other apps and metrics.

I hope what I'm explaining is clear and any help would be appreciated. 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| spath value{} output=value
| mvexpand value
| spath input=value
| where APPLICATION_NAME="certain app"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| spath value{} output=value
| mvexpand value
| spath input=value
| where APPLICATION_NAME="certain app"

paulito
Explorer

Works perfectly, thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...