Splunk Search

How to use an if on Tags ?

djacquens
Path Finder

Hi,

I am new to SPLUNK/SPL and I am wondering how can I check if the Tags field contains a tag "foo" within an eval.

Something like:

eval toto = if("tags{}" == "foo", 1,2)'

Thanks,

David

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

No, you can't simply use wildcards in field names. But you can try one of two approaches.

If you indeed have multiple tags.* fields parsed out, you can try combine them into a single string (or a multivalue field) using foreach and then search on that field. Ugly but should work.

Or you can use spath to extract the tags section into a separate field and then just use a regex match. Also ugly. 😉

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Ahhhh... So it's not a tag in terms of "normal" splunk tags. It's just that you have a section of your json event called tags and it has some fields inside.

Does it parse properly? If so, you should probably have fields called tags.*.

So your problem is that you want to find a value among a set of fields.

I'm not sure you can use wildcards in fields specification.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

No, you can't simply use wildcards in field names. But you can try one of two approaches.

If you indeed have multiple tags.* fields parsed out, you can try combine them into a single string (or a multivalue field) using foreach and then search on that field. Ugly but should work.

Or you can use spath to extract the tags section into a separate field and then just use a regex match. Also ugly. 😉

djacquens
Path Finder

OK thank you very much.

I used spath:

 

| spath tags{} output=toto
| eval aa = if(mvfind(toto, "tag_searched")>0, "A", "B")

 

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

| eval mvfind(tag,"foo")

0 Karma

djacquens
Path Finder

Thank you @PickleRick

I tried using mvfind but without any luck.

index = "phantom_container" earliest=-1d 
| dedup id
| eval foo = if(isnull(mvfind(tags, "xyz")), «A» , «B»)

tags_tenantid.png

I guess I am not using the correct syntax to access the tags field.
I have the same issue with the field tenant_id.

What am I missing?

Thanks in advance,

David



 

 

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...