Splunk Search

event values have same name

scumbum
New Member

My event data contains the following:

target[ 
     { 
       alternateIdapplication1
       detailEntry: { 
       }

       displayNameOpenID Connect Client
       idasdfasdf
       typeAppInstance
     }
     { 
       alternateIdunknown
       detailEntrynull
       displayNameUnregistered Device - Default
       id: adsfasdf
       typeRule

I want to do a | stats count by target.displayname but only on events that have target.type=Rule. It is possible to have more than two entries as well so cant just say always select second entry.

Labels (4)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

A pointer: When anonymizing structured data, make sure the structure itself is compliant.  I think you mean your event looks like

{"target": [
     { 
       "alternateId": "application1",
       "detailEntry": {
       },
       "displayName": "OpenID Connect Client",
       "id": "asdfasdf",
       "type": "AppInstance"
     },
     { 
       "alternateId": "unknown",
       "detailEntry": "null",
       "displayName": "Unregistered Device - Default",
       "id": "adsfasdf",
       "type": "Rule"
     }
  ]
}

You can use mvexpand before filter or use mvfilter.  Using mvexpand is more traditional:

| spath path=target{}
| mvexpand target{}
| where json_extract('target{}', "type") == "Rule"
| eval displayName = json_extract(target, "displayName")

Use of JSON functions above assumes that you use Splunk 8 or later, but the mvexpand method can still work without JSON functions; you just use another round of spath.

Using mvfilter, on the other hand, requires JSON functions first introduced in Splunk 8.

| spath path=target{}
| eval target = mvfilter(json_extract('target{}', "type") == "Rule")
| eval displayName = json_extract(target, "displayName")

Hope this helps. 

Tags (3)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...