How to search over a field when it's JSON and has many different top level fields? Stars in field names? Aliases or spath?

[thisissplunk]

I have events that come in as JSON. That works fine, but I'm having trouble searching for a value in a field that has many different Country names as the top level. Let me illustrate:

Fields----
America.result
America.participant
Australia.result
Australia.participant
Canada.result
Canada.participant
Olympic_event
timestamp

What I want to do is this:

 index=* *.participant="John*"

But stars in field names don't work. I had googled this and found out about making an alias using the stars in a config, but can't find it again. Using the explicit top level name is not acceptable either, as I'll never know which ones exist, or when new ones will pop up in the events. For the sake of argument, a new world might be found and their olympians will have names and results too. Example of what I mean:

index=* America.participant=John* OR Canada.participant=John* OR Australia.participant=John*

Not acceptable ^. "Arwkanda" might be a country that pops up in the results tomorrow.

Anyone have any ideas?

[sundareshr]

Have you tried not specifying a field name. Just search index=* John* or index=* "*participant=John*"

[MuS]

Hi thisissplunk,

How about you create a new field for the unknown and known worlds by using a stats :

your search to find all events you need 
| stats values(*.participant) AS countries by _time 
| search countries=Arwkanda | more Splunk-Fu

Hope this helps ...

cheers, MuS

[jeffland]

You could use foreach to iterate over all fields which end in participant, concatenate the contents of these fields in a new field and then search that new field:

index=* | eval participant="" | foreach *".participant" [eval participant=participant." ".'<<FIELD>>'] | search participant=" John*"

This simple thing will prepend a whitespace before the values of your new field, which is why you need one in the search as well. You could of course adjust the eval to your liking if this is inconvenient for you.