Splunk Search

How to filter an array element based two fields?

jiangxue
New Member

I am trying to get all the event within the 'browsers' field there is an element with name=IE && data!=null

here is an example of the event. The order of those browsers can be anything. Some browser may have not data field.

1 How do I find those events that has this kind of element in 'browsers'
2 How do I extract the 'data' field of particular browser, like IE

browsers[

{ name: firefox
data:[
{
usage: 10
time: 200
}
]
},

{ name: IE
data:[
{
usage: 30
time: 400
},
{
usage: 20
time: 500
}
]
},

{ name: Chrome
},
….

]

Tags (3)
0 Karma

MuS
Legend

Hi jiangxue,

try something like this run everywhere search:

index=_internal | head 1 | eval foo="browsers[ {  name: firefox
   data:[
   {
   usage: 10
   time: 200
   }
  ]
},

{  name: IE
   data:[
   {
   usage: 30
   time: 400
   },
   {
   usage: 20
   time: 500
   }
  ]
},

{  name: Chrome
},
….

]" 
| rex max_match=0 field=foo "name:\s(?<myBrowser>.+)\s" 
| rex max_match=0 field=foo "usage:\s(?<myUsage>.+)\s" 
| table myBrowser myUsage 

the first part is only to setup the test field called foo, based on your example.

The two following regex's will get you two new fields called myBroswer and myUsage. Set this up as automatic field extraction and do your stats on it.

I also tried spath but did not get any useful output, so I used rex instead

hope this hepls to get you going ...

cheers, MuS

0 Karma

MuS
Legend

thx @martin_mueller I knew that.
I wrote it because I was curious myself if the spath command can do some hidden magic and handle this almost JSON like output just the same 😉

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You're not getting anything useful with spath because this is neither JSON nor XML.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...