Splunk Search

How to use an if on Tags ?

djacquens
Path Finder

Hi,

I am new to SPLUNK/SPL and I am wondering how can I check if the Tags field contains a tag "foo" within an eval.

Something like:

eval toto = if("tags{}" == "foo", 1,2)'

Thanks,

David

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

No, you can't simply use wildcards in field names. But you can try one of two approaches.

If you indeed have multiple tags.* fields parsed out, you can try combine them into a single string (or a multivalue field) using foreach and then search on that field. Ugly but should work.

Or you can use spath to extract the tags section into a separate field and then just use a regex match. Also ugly. 😉

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Ahhhh... So it's not a tag in terms of "normal" splunk tags. It's just that you have a section of your json event called tags and it has some fields inside.

Does it parse properly? If so, you should probably have fields called tags.*.

So your problem is that you want to find a value among a set of fields.

I'm not sure you can use wildcards in fields specification.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

No, you can't simply use wildcards in field names. But you can try one of two approaches.

If you indeed have multiple tags.* fields parsed out, you can try combine them into a single string (or a multivalue field) using foreach and then search on that field. Ugly but should work.

Or you can use spath to extract the tags section into a separate field and then just use a regex match. Also ugly. 😉

djacquens
Path Finder

OK thank you very much.

I used spath:

 

| spath tags{} output=toto
| eval aa = if(mvfind(toto, "tag_searched")>0, "A", "B")

 

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

| eval mvfind(tag,"foo")

0 Karma

djacquens
Path Finder

Thank you @PickleRick

I tried using mvfind but without any luck.

index = "phantom_container" earliest=-1d 
| dedup id
| eval foo = if(isnull(mvfind(tags, "xyz")), «A» , «B»)

tags_tenantid.png

I guess I am not using the correct syntax to access the tags field.
I have the same issue with the field tenant_id.

What am I missing?

Thanks in advance,

David



 

 

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...