Splunk Search

How to search against multiple elements

47024
New Member

I'm trying to capture occurrences when multiple criteria are true in an event where elements can exist multiple times in the message.

For example, with the below event I want to capture how often events have an element that is both id=A and width>600.

Because there are multiple walls I can easily filter when any element has an id=A or a width>600, but I cannot figure out how to filter where both criteria are met.

Example message below:

elements: [
   {
      id: A
      width: 585
   }
   {
      id: B
      width: 605
   }
]
0 Karma
1 Solution

aberkow
Builder

You can either leverage the spath command https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Spath to make the data easier to work with, or look at the answer posted here: https://answers.splunk.com/answers/784418/dynamic-loop-through-a-json-array-looking-for-trig.html#an...

Essentially, you need to create a pairing between id and width, separate them into their own rows, index them out, and then run your search:

{code}
your_base_search
| eval id_zip_width=mvzip(id,width)
| mvexpand id_zip_width
| eval id_zip_width=split(id_zip_width,",")
| eval id=mvindex(id_zip_width,0)
| eval width=mvindex(id_zip_width,1)
| search id="A" and width>600
{code}

Hope this helps!

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

... | eval _raw = mvzip(id, width, "=")
| kv
| where A>600
0 Karma

aberkow
Builder

You can either leverage the spath command https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Spath to make the data easier to work with, or look at the answer posted here: https://answers.splunk.com/answers/784418/dynamic-loop-through-a-json-array-looking-for-trig.html#an...

Essentially, you need to create a pairing between id and width, separate them into their own rows, index them out, and then run your search:

{code}
your_base_search
| eval id_zip_width=mvzip(id,width)
| mvexpand id_zip_width
| eval id_zip_width=split(id_zip_width,",")
| eval id=mvindex(id_zip_width,0)
| eval width=mvindex(id_zip_width,1)
| search id="A" and width>600
{code}

Hope this helps!

0 Karma

47024
New Member

This worked! Thank you very much.

0 Karma

woodcock
Esteemed Legend

Be sure to try mine; it should scale better and is much shorter.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...