Splunk Search

How to filter first array element?

andreaantonioni
Observer

My data is something like this:

 

stackTrace: [
{
   inProject: false,
   file: "/path/to/file.c"
},
{
   inProject: true,
   file: "/path/to/file.c"
}, 
{
   inProject: false,
   file: "/path/to/file.c"
}
]

 

  I'd like to get the list of events where the first element that has inProject=true contains "file.c" in file.

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Well, the wording here is a little tricky because if reading your request literarily, something like this:

stackTrace: [
{
   inProject: true,
   file: "/path/to/otherfile.c"
},
{
   inProject: true,
   file: "/path/to/file.c"
}
]

Should not match. (Bonus question about the filename matching but i suppose you want the literal "file.c" as whole filename, so the "otherfile.c" is something you don't want. Otherwise of course you can adjust the example accordingly.

0 Karma

somesoni2
Revered Legend

If your data is indexed and parsed correctly (as valid json element), something like this should work.

Your current search which includes field with name stackTrace{}.inProject and stackTrace{}.file
| where mvindex('stackTrace{}.inProject',0)="false" AND like('stackTrace{}.inProject',"%file.c")

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| spath stackTrace{} output=stackTrace
| mvexpand stackTrace
| spath input=stackTrace
| where inProject="true" AND match(file,"file\.c")
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...