Splunk Search

Splunk query

ash2
Explorer

Hi All, hope you are having a great day, I have a quick question. I have the data given as below, how do i extract just the first value if attribute newValue (in our Eg., its "None"), first value of newValue keeps changing so cannot be hard-coded.
```{}```

{
targetResources: [ 
     { 
       displayName: null
       groupType: null
       id: f61b1166
       modifiedProperties: [ 
         { 
           displayName: PasswordPolicies
           newValue: ["None"]                                             // extract only this value
           oldValue: ["DisablePasswordExpiration"]
         }
         { 
           displayName: Included Updated Properties
           newValue: "PasswordPolicies"
           oldValue: null
         }
         { 
           displayName: TargetId.UserType
           newValue: "Member"
           oldValue: null
         }
       ]
}

Labels (2)
0 Karma
1 Solution

ash2
Explorer

I found the solution. 

| eval firstNewValue = mvindex(newValue,0)



 

View solution in original post

0 Karma

ash2
Explorer

I found the solution. 

| eval firstNewValue = mvindex(newValue,0)



 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ash2 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

PickleRick
SplunkTrust
SplunkTrust

I'm not sure what you mean but if you want the value of the newValue field from the first object in the modifiedProperties array, you can use spath to extract value from particular node of your json structure.

| spath targetResources[0].modifiedProperties[0].newValue[0]

(if I remember the path syntax correctly; writing from memory)

0 Karma

ash2
Explorer

Thanks @PickleRick , 

the query line you posted is not supported, not if it was before. Splunk is erring out saying unknown value 0

0 Karma

ash2
Explorer

Hi Giuseppe,

Thank you for the query, unfortunately its not working for me. 

ash2_0-1715837329255.png

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ash2,

max_match is an option of the rex command that says to the rex to take only the first extracted value, it isn't a field to display.

please try this (adding the new field (newValue2) to the table to see the difference:

| rex max_match=1 "(?ms)newValue:\s+\[*\"(?<newValue2>[^\"]+)"

Ciao.

Giuseppe

0 Karma

ash2
Explorer

Hi Giuseppe,

Thank you for highlighting the mistake. I corrected the variable to newValue2 but unfortunately I found no luck  with the  query.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ash2,

please try this:

| rex max_match=1 "(?ms)newValue:\s+\[*\"(?<newValue>[^\"]+)"

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...