Splunk Search

Search within dynamic list of items

splkuser20
Loves-to-Learn

I have an item to search withing logs with the schema similar to one below.  It is kind of searching for certain uri and status within a dynamic list of items.. item_1, item_2, item_N

log": {
"type": "web""datetime": "xxxxx"

"data": {
"item_1": {
"httpstatus": "200",
"path": "/pr/s1"
},
"item_2":  {
"httpstatus": "200",
"path": "/pr/s2"
}
}
}

I am kind of wondering how to make Item_*  search with a regex. So , in this case it's the field name which would need regex.  Any pointers on where to start

Labels (4)
Tags (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

if the event you posted is json, then it should be parsed automatically.

do you want to extract item_1=value and item_2=value and so on?

————————————
If this helps, give a like below.
0 Karma

splkuser20
Loves-to-Learn

so.. in query/search , the value of the item would be used as a parameter, and result shoud only show ones matching

say searching for a value within all item_*, ones that match should show up.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...