Splunk Search
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Splunk searching nested json
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
blaku
Explorer
08-11-2018
11:17 PM
Hello
I use automatic translation because I am not good at English. sorry.
I took NVD 's CVE list (Json Feed) into Splunk.
That's index="testIndex" product_name = "openssl" "version_data" = "1.6.0" Searching with
There is no "1.6.0" in the version of openssl
I want to link product with version but it does not work as expected.
I can't get spath or mvexpand to extract the nested arrays properly
Someone help me.
{
"cve" : {
"CVE_data_meta" : {
"ID" : "CVE-2013-0169",
"ASSIGNER" : "cve@mitre.org"
},
"affects" : {
"vendor" : {
"vendor_data" : [ {
"vendor_name" : "openssl",
"product" : {
"product_data" : [ {
"product_name" : "openssl",
"version" : {
"version_data" : [ {
"version_value" : "*"
}, {
"version_value" : "0.9.8"
}, {
"version_value" : "0.9.8a"
}, {
"version_value" : "0.9.8b"
}, {
"version_value" : "0.9.8c"
}, {
"version_value" : "0.9.8d"
}, {
"version_value" : "0.9.8f"
}, {
"version_value" : "0.9.8g"
} ]
}
} ]
}
}, {
"vendor_name" : "oracle",
"product" : {
"product_data" : [ {
"product_name" : "openjdk",
"version" : {
"version_data" : [ {
"version_value" : "-"
}, {
"version_value" : "1.6.0"
}, {
"version_value" : "1.7.0"
} ]
}
} ]
}
}, {
"vendor_name" : "polarssl",
"product" : {
"product_data" : [ {
"product_name" : "polarssl",
"version" : {
"version_data" : [ {
"version_value" : "0.10.0"
}, {
"version_value" : "0.10.1"
}, {
"version_value" : "0.11.0"
} ]
}
} ]
}
} ]
}
}
},
"publishedDate" : "2013-02-08T19:55Z",
"lastModifiedDate" : "2018-08-09T01:29Z"
}
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
renjith_nair
Legend
08-12-2018
01:11 AM
@blaku,
Try
|makeresults |eval json=" {
\"cve\" : {
\"CVE_data_meta\" : {
\"ID\" : \"CVE-2013-0169\",
\"ASSIGNER\" : \"cve@mitre.org\"
},
\"affects\" : {
\"vendor\" : {
\"vendor_data\" : [ {
\"vendor_name\" : \"openssl\",
\"product\" : {
\"product_data\" : [ {
\"product_name\" : \"openssl\",
\"version\" : {
\"version_data\" : [ {
\"version_value\" : \"*\"
}, {
\"version_value\" : \"0.9.8\"
}, {
\"version_value\" : \"0.9.8a\"
}, {
\"version_value\" : \"0.9.8b\"
}, {
\"version_value\" : \"0.9.8c\"
}, {
\"version_value\" : \"0.9.8d\"
}, {
\"version_value\" : \"0.9.8f\"
}, {
\"version_value\" : \"0.9.8g\"
} ]
}
} ]
}
}, {
\"vendor_name\" : \"oracle\",
\"product\" : {
\"product_data\" : [ {
\"product_name\" : \"openjdk\",
\"version\" : {
\"version_data\" : [ {
\"version_value\" : \"-\"
}, {
\"version_value\" : \"1.6.0\"
}, {
\"version_value\" : \"1.7.0\"
} ]
}
} ]
}
}, {
\"vendor_name\" : \"polarssl\",
\"product\" : {
\"product_data\" : [ {
\"product_name\" : \"polarssl\",
\"version\" : {
\"version_data\" : [ {
\"version_value\" : \"0.10.0\"
}, {
\"version_value\" : \"0.10.1\"
}, {
\"version_value\" : \"0.11.0\"
} ]
}
} ]
}
} ]
}
}
},
\"publishedDate\" : \"2013-02-08T19:55Z\",
\"lastModifiedDate\" : \"2018-08-09T01:29Z\"
}"
|spath input=json output=product_name path=cve.affects.vendor.vendor_data{}.product{}.product_data{}.product_name
|spath input=json output=version path=cve.affects.vendor.vendor_data{}.product{}.product_data{}.version
|eval z=mvzip(product_name,version,"#")|table z| mvexpand z
|eval s=split(z,"#")|eval Product=mvindex(s,0),Version=mvindex(s,1)|fields Product,Version
|spath input=Version output=Versions path=version_data{}.version_value
|table Product,Versions
|mvexpand Versions
---
What goes around comes around. If it helps, hit it with Karma 🙂
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vmacedo
Explorer
12-04-2019
12:39 PM
Here is another solution, but this one does not need mvzip, split or mvindex:
|makeresults |eval json=" {
\"cve\" : {
\"CVE_data_meta\" : {
\"ID\" : \"CVE-2013-0169\",
\"ASSIGNER\" : \"cve@mitre.org\"
},
\"affects\" : {
\"vendor\" : {
\"vendor_data\" : [ {
\"vendor_name\" : \"openssl\",
\"product\" : {
\"product_data\" : [ {
\"product_name\" : \"openssl\",
\"version\" : {
\"version_data\" : [ {
\"version_value\" : \"*\"
}, {
\"version_value\" : \"0.9.8\"
}, {
\"version_value\" : \"0.9.8a\"
}, {
\"version_value\" : \"0.9.8b\"
}, {
\"version_value\" : \"0.9.8c\"
}, {
\"version_value\" : \"0.9.8d\"
}, {
\"version_value\" : \"0.9.8f\"
}, {
\"version_value\" : \"0.9.8g\"
} ]
}
} ]
}
}, {
\"vendor_name\" : \"oracle\",
\"product\" : {
\"product_data\" : [ {
\"product_name\" : \"openjdk\",
\"version\" : {
\"version_data\" : [ {
\"version_value\" : \"-\"
}, {
\"version_value\" : \"1.6.0\"
}, {
\"version_value\" : \"1.7.0\"
} ]
}
} ]
}
}, {
\"vendor_name\" : \"polarssl\",
\"product\" : {
\"product_data\" : [ {
\"product_name\" : \"polarssl\",
\"version\" : {
\"version_data\" : [ {
\"version_value\" : \"0.10.0\"
}, {
\"version_value\" : \"0.10.1\"
}, {
\"version_value\" : \"0.11.0\"
} ]
}
} ]
}
} ]
}
}
},
\"publishedDate\" : \"2013-02-08T19:55Z\",
\"lastModifiedDate\" : \"2018-08-09T01:29Z\"
}"
|spath input=json output=product_data path=cve.affects.vendor.vendor_data{}.product{}.product_data{}
|mvexpand product_data
|spath input=product_data path=product_name
|spath input=product_data output=version path=version.version_data{}.version_value
|mvexpand version
|table product_name, version
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
to4kawa
Ultra Champion
12-05-2019
05:38 AM
Great! thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
afroz
Path Finder
08-12-2018
02:49 AM
Hi,
Map JSON logs to _json sourcetype.
In the props.conf file create stanza like below.
[_json]
KV_MODE= json
It will extract fields. So don't need to search nested json files. Just search fields you require.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
renjith_nair
Legend
08-12-2018
01:11 AM
@blaku,
Try
|makeresults |eval json=" {
\"cve\" : {
\"CVE_data_meta\" : {
\"ID\" : \"CVE-2013-0169\",
\"ASSIGNER\" : \"cve@mitre.org\"
},
\"affects\" : {
\"vendor\" : {
\"vendor_data\" : [ {
\"vendor_name\" : \"openssl\",
\"product\" : {
\"product_data\" : [ {
\"product_name\" : \"openssl\",
\"version\" : {
\"version_data\" : [ {
\"version_value\" : \"*\"
}, {
\"version_value\" : \"0.9.8\"
}, {
\"version_value\" : \"0.9.8a\"
}, {
\"version_value\" : \"0.9.8b\"
}, {
\"version_value\" : \"0.9.8c\"
}, {
\"version_value\" : \"0.9.8d\"
}, {
\"version_value\" : \"0.9.8f\"
}, {
\"version_value\" : \"0.9.8g\"
} ]
}
} ]
}
}, {
\"vendor_name\" : \"oracle\",
\"product\" : {
\"product_data\" : [ {
\"product_name\" : \"openjdk\",
\"version\" : {
\"version_data\" : [ {
\"version_value\" : \"-\"
}, {
\"version_value\" : \"1.6.0\"
}, {
\"version_value\" : \"1.7.0\"
} ]
}
} ]
}
}, {
\"vendor_name\" : \"polarssl\",
\"product\" : {
\"product_data\" : [ {
\"product_name\" : \"polarssl\",
\"version\" : {
\"version_data\" : [ {
\"version_value\" : \"0.10.0\"
}, {
\"version_value\" : \"0.10.1\"
}, {
\"version_value\" : \"0.11.0\"
} ]
}
} ]
}
} ]
}
}
},
\"publishedDate\" : \"2013-02-08T19:55Z\",
\"lastModifiedDate\" : \"2018-08-09T01:29Z\"
}"
|spath input=json output=product_name path=cve.affects.vendor.vendor_data{}.product{}.product_data{}.product_name
|spath input=json output=version path=cve.affects.vendor.vendor_data{}.product{}.product_data{}.version
|eval z=mvzip(product_name,version,"#")|table z| mvexpand z
|eval s=split(z,"#")|eval Product=mvindex(s,0),Version=mvindex(s,1)|fields Product,Version
|spath input=Version output=Versions path=version_data{}.version_value
|table Product,Versions
|mvexpand Versions
---
What goes around comes around. If it helps, hit it with Karma 🙂
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
blaku
Explorer
08-14-2018
09:23 PM
@renjith.nair
Hi
When I tried it worked without problem.
It is movement as expected.
Thank you very much
Get Updates on the Splunk Community!
Splunk App for Anomaly Detection End of Life Announcement
Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...
Aligning Observability Costs with Business Value: Practical Strategies
Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...
Mastering Data Pipelines: Unlocking Value with Splunk
In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...
