Im working with JSON data and the structure is as per the below
data: { [-]
application: { [+]
}
completedAt: 1636133794444
environments: [ [-]
{ [-]
id: XNu1-l8oROOOSM5gpoSR0g
}
{ [-]
id: _LY0B7VpRq64tHXq7Uy55A
}
{ [-]
id: 7KbvgSBMSUSUyAn2hMXSQA
}
{ [-]
id: dJ7EuItjSG2M47-zvIvimQ
}
]
Now when i use a case function for this like the below:
|eval env = case('data.environments{}.id'=="7KbvgSBMSUSUyAn2hMXSQA", "prd-au", 'data.environments{}.id'=="_LY0B7VpRq64tHXq7Uy55A", "prd-gb")
It only ever brings me back 1 result and thats whatever is placed first in the case function so the above returns prd-au and if i swap the values around then it will return prd-gb. I presume this is something to do with how the JSON data is working with splunk causing it to error out but unsure how to resolve?
any ideas?
You would need to expand the event into multiple events, try something like this
| mvexapnd 'data.environments{}.id'
thanks @ITWhisperer is there a way round this so i can get all values?
You would need to expand the event into multiple events, try something like this
| mvexapnd 'data.environments{}.id'
Splunk is working with a pipeline of events - the events in the pipeline include multivalue fields such as data.environments{}.id - the eval case finds a match among the multivalues for the first test hence you get the results you are getting