Splunk Search

Splunk query

ash2
Explorer

Hi All, hope you are having a great day, I have a quick question. I have the data given as below, how do i extract just the first value if attribute newValue (in our Eg., its "None"), first value of newValue keeps changing so cannot be hard-coded.
```{}```

{
targetResources: [ 
     { 
       displayName: null
       groupType: null
       id: f61b1166
       modifiedProperties: [ 
         { 
           displayName: PasswordPolicies
           newValue: ["None"]                                             // extract only this value
           oldValue: ["DisablePasswordExpiration"]
         }
         { 
           displayName: Included Updated Properties
           newValue: "PasswordPolicies"
           oldValue: null
         }
         { 
           displayName: TargetId.UserType
           newValue: "Member"
           oldValue: null
         }
       ]
}

Labels (2)
0 Karma
1 Solution

ash2
Explorer

I found the solution. 

| eval firstNewValue = mvindex(newValue,0)



 

View solution in original post

0 Karma

ash2
Explorer

I found the solution. 

| eval firstNewValue = mvindex(newValue,0)



 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ash2 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

PickleRick
SplunkTrust
SplunkTrust

I'm not sure what you mean but if you want the value of the newValue field from the first object in the modifiedProperties array, you can use spath to extract value from particular node of your json structure.

| spath targetResources[0].modifiedProperties[0].newValue[0]

(if I remember the path syntax correctly; writing from memory)

0 Karma

ash2
Explorer

Thanks @PickleRick , 

the query line you posted is not supported, not if it was before. Splunk is erring out saying unknown value 0

0 Karma

ash2
Explorer

Hi Giuseppe,

Thank you for the query, unfortunately its not working for me. 

ash2_0-1715837329255.png

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ash2,

max_match is an option of the rex command that says to the rex to take only the first extracted value, it isn't a field to display.

please try this (adding the new field (newValue2) to the table to see the difference:

| rex max_match=1 "(?ms)newValue:\s+\[*\"(?<newValue2>[^\"]+)"

Ciao.

Giuseppe

0 Karma

ash2
Explorer

Hi Giuseppe,

Thank you for highlighting the mistake. I corrected the variable to newValue2 but unfortunately I found no luck  with the  query.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ash2,

please try this:

| rex max_match=1 "(?ms)newValue:\s+\[*\"(?<newValue>[^\"]+)"

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...