How to list _key value pairs for all entities in ITSI ?

[Suara]

Hello all ! 

Can anyone help me in editing the below SPL so it can only list the _key - value paris for the entities ? 

| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/entity report_as=text
fields="_key,title,identifier,informational,identifying_name"
| eval value=spath(value,"{}")
| mvexpand value
| eval entity_title=spath(value, "title"),
entity_name=spath(value, "identifying_name"),
entity_aliases=mvzip(spath(value, "identifier.fields{asd}"),spath(value, "identifier.values{}"),"="),
entity_info=mvzip(spath(value, "informational.fields{}"),spath(value, "informational.values{}"),"=")


This is a solution i found online but its rather complicated for my SPL skills at the moment.... 

Thank you in advance ! 

[yuanliu]

Maybe you can share sample search results (full text, anonymize as needed) and let us know which XML nodes represent "entities"?  Is there anything wrong with the search you posted?  If the search produces what you need, what kind of change do you want?

Based on that posted search, I speculate that there is no inherent structure in search results that tells user what are key-value pairs of an "entity".  In other words, the so-called "entity" is a construct invented by whoever posted this search.  Without knowing actual data structure, it is fruitless for volunteers to try simplification.

[Suara]

Hey thanks for the comment ! I will formulate my question better and share more information as needed