Splunk Search

Splunk : Spath searching the JSON array

ashishmgupta
Explorer

I have below two JSON events where under "appliedConditionalAccessPolicies", in one event policy1 has results =failure and policy2 has results=notApplied. In the other event the values are reversed.

Now I'm trying to get the event where the policy1 has the status="failure", it gives both the events

 

index=test
| spath path="appliedConditionalAccessPolicies{}" | search "appliedConditionalAccessPolicies{}.displayName"="policy1" "appliedConditionalAccessPolicies{}.result"="failure"

 

I have below two JSON events where under "appliedConditionalAccessPolicies", in one event policy1 has results =failure and policy2 has results=notApplied. In the other event the values are reversed.

Now I'm trying to get the event where the policy1 has the status="failure", it gives both the events

index=test
| spath path="appliedConditionalAccessPolicies{}" | search "appliedConditionalAccessPolicies{}.displayName"="policy1" "appliedConditionalAccessPolicies{}.result"="failure"

It looks like Its searching within all the elements in the array. How can I ensure It searches both the conditions on each element of the array and return the event which has the element satisfying both the conditions.

Events :

 

appDisplayName: App1
   appId: aaaa-1111-111aeff-aad222221111
   appliedConditionalAccessPolicies: [ 
     { 
       displayName: policy1
       enforcedGrantControls: [
         Block
       ]
       enforcedSessionControls: [
         SignInFrequency
         ContinuousAccessEvaluation
       ]
       id: f111113-111-400c-a251-2123bbe4233e1
       result: failure
     }
     { [-]
       displayName: policy2
       enforcedGrantControls: [ [-]
         Block
       ]
       enforcedSessionControls: [ [-]
       ]
       id: sdsds-8c92-45ef-sdsds-c0b2e006d39b
       result: notApplied
     }
   ]
   
   appDisplayName: App1
   appId: aaaa-1111-111aeff-aad222221111
   appliedConditionalAccessPolicies: [ 
     { 
       displayName: policy1
       enforcedGrantControls: [
         Block
       ]
       enforcedSessionControls: [
         SignInFrequency
         ContinuousAccessEvaluation
       ]
       id: f111113-111-400c-a251-2123bbe4233e1
       result: notApplied
     }
     { [-]
       displayName: policy2
       enforcedGrantControls: [ [-]
         Block
       ]
       enforcedSessionControls: [ [-]
       ]
       id: sdsds-8c92-45ef-sdsds-c0b2e006d39b
       result: failure
     }
   ]

 

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...