Splunk Search

How to get only matching block values from nested json?

chetanN
Loves-to-Learn Lots

Hi all,

To give a problem background, I am trying to run a map command inside a search to get some values. THE JSON I am trying to access (sample below) has nested JSONs where I only need to read and derive value for the matched block. But as of now, my table command prints 3 rows instead of one (one row for each nested  JSON). I would like to print only the matching JSON block and ignore the other.

I think rex and spath will be required here but it was still printing 3 rows as the final output but I need to print only 1 row. Not sure how to use them correctly to get the results. Please help.

my sample search:

Index=Dummy X.id=AA11

| eval version=X.version
| eval connTrain=X.conTrainId----(value is TR2)

| map Index=ABC Y.TrainID=AA11 Y.version=$version$

Sample JSON is given below. In this case, I need to only access TR2 (second block)  and print its time and passenger value. In real-time, there can be only 1 JSON block or many and matching block can be at any location in case of multiple blocks.

{
          TrainID=AA11
            "TrainData": [
                    {

                        "ConnectingTrain": {
                                   "TR1": {
                                                  "connectionTime": "59",
                                                    "TotalPassengers": "44",
                                               },
                                 "TR2": {
                                                   "connectionTime": "33",
                                                    "TotalPassengers": "47",
                                              },
                               "TR3": {
                                                 "connectionTime": "51",
                                                 "TotalPassengers": "27",
                                             }
                                      }
                            }
                ]
}
Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

If you're posting a search, please include it in code block or a preformatted style - it helps reading and prevents the web service from mangling the indentations and so on. :slightly_smiling_face:

Don't use map if you can avoid it! I know it's tempting, especially for someone new to Splunk (I've been there myself ;-)) but it's usually an attempt to do something in Splunk as you would normally do in other soultion (like SQL). It's most often not the way to go.

Try to describe what you want to achieve.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...