Splunk Search

How to use an if on Tags ?

djacquens
Path Finder

Hi,

I am new to SPLUNK/SPL and I am wondering how can I check if the Tags field contains a tag "foo" within an eval.

Something like:

eval toto = if("tags{}" == "foo", 1,2)'

Thanks,

David

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

No, you can't simply use wildcards in field names. But you can try one of two approaches.

If you indeed have multiple tags.* fields parsed out, you can try combine them into a single string (or a multivalue field) using foreach and then search on that field. Ugly but should work.

Or you can use spath to extract the tags section into a separate field and then just use a regex match. Also ugly. 😉

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Ahhhh... So it's not a tag in terms of "normal" splunk tags. It's just that you have a section of your json event called tags and it has some fields inside.

Does it parse properly? If so, you should probably have fields called tags.*.

So your problem is that you want to find a value among a set of fields.

I'm not sure you can use wildcards in fields specification.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

No, you can't simply use wildcards in field names. But you can try one of two approaches.

If you indeed have multiple tags.* fields parsed out, you can try combine them into a single string (or a multivalue field) using foreach and then search on that field. Ugly but should work.

Or you can use spath to extract the tags section into a separate field and then just use a regex match. Also ugly. 😉

djacquens
Path Finder

OK thank you very much.

I used spath:

 

| spath tags{} output=toto
| eval aa = if(mvfind(toto, "tag_searched")>0, "A", "B")

 

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

| eval mvfind(tag,"foo")

0 Karma

djacquens
Path Finder

Thank you @PickleRick

I tried using mvfind but without any luck.

index = "phantom_container" earliest=-1d 
| dedup id
| eval foo = if(isnull(mvfind(tags, "xyz")), «A» , «B»)

tags_tenantid.png

I guess I am not using the correct syntax to access the tags field.
I have the same issue with the field tenant_id.

What am I missing?

Thanks in advance,

David



 

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...