Splunk Search

How to filter first array element?

andreaantonioni
Observer

My data is something like this:

 

stackTrace: [
{
   inProject: false,
   file: "/path/to/file.c"
},
{
   inProject: true,
   file: "/path/to/file.c"
}, 
{
   inProject: false,
   file: "/path/to/file.c"
}
]

 

  I'd like to get the list of events where the first element that has inProject=true contains "file.c" in file.

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Well, the wording here is a little tricky because if reading your request literarily, something like this:

stackTrace: [
{
   inProject: true,
   file: "/path/to/otherfile.c"
},
{
   inProject: true,
   file: "/path/to/file.c"
}
]

Should not match. (Bonus question about the filename matching but i suppose you want the literal "file.c" as whole filename, so the "otherfile.c" is something you don't want. Otherwise of course you can adjust the example accordingly.

0 Karma

somesoni2
Revered Legend

If your data is indexed and parsed correctly (as valid json element), something like this should work.

Your current search which includes field with name stackTrace{}.inProject and stackTrace{}.file
| where mvindex('stackTrace{}.inProject',0)="false" AND like('stackTrace{}.inProject',"%file.c")

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| spath stackTrace{} output=stackTrace
| mvexpand stackTrace
| spath input=stackTrace
| where inProject="true" AND match(file,"file\.c")
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...