Splunk Search

How to extract info from nested data with specific parameter?

paulito
Explorer

Aternity Extraction.png

 

I need to extract the Activity Score and Application UXI Average but only when the Application Name is a certain name. 

It's a weird one for me because of the way data comes in. As you can see each event has multiple application names, activity scores, uxi averages and timeframes. So even when I specify for a certain app in a search, since the app name is in an event, I get the whole event which includes all the other apps and metrics.

I hope what I'm explaining is clear and any help would be appreciated. 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| spath value{} output=value
| mvexpand value
| spath input=value
| where APPLICATION_NAME="certain app"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| spath value{} output=value
| mvexpand value
| spath input=value
| where APPLICATION_NAME="certain app"

paulito
Explorer

Works perfectly, thank you!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

The updated Splunk Add-on for Microsoft Windows helps customers search Windows events faster by reducing ...

What's New in Splunk Enterprise Security 8.8 and Beyond

Threats move at machine speed. Keeping up should not depend on having the biggest budget, the largest team, or ...

A Four-Part Event Series: State of Observability - Where AI Meets Performance

As AI agents take on more complex tasks, teams need greater visibility into how they behave, what they cost, ...