Splunk Search

mvexpand multi-value fields when not null

khenson
Engager

Hi all.  I'm trying to create a table from AWS WAF logs.  There is a section of the log that is called ruleGroupList{} and it is a list containing multiple dictionaries.  Sometimes there is field called "excludedRules" that is null.  When it is not null, it is a list containing a dictionary with a field called ruleId.

   ruleGroupList: [ [-]
     { [-]
       excludedRulesnull
       nonTerminatingMatchingRules: [ [+]
       ]

       ruleGroupIdAWS#AWSManagedRulesBotControlRuleSet
       terminatingRulenull
     }
     { [-]
       excludedRules: [ [-]
         { [-]
           exclusionTypeEXCLUDED_AS_COUNT
           ruleIdSizeRestrictions_BODY
         }
       ]

       nonTerminatingMatchingRules: [ [+]
       ]

       ruleGroupIdAWS#AWSManagedRulesCommonRuleSet
       terminatingRulenull
     }

In this case, I want to:

list the ruleGroupList{}.ruleGroupId and the ruleGroupList{}.excludedRules{}.ruleId in a table,
when ruleGroupList{}.excludedRules is not NULL. 

If it is NULL, then I don't want to display the values for that dictionary.  There are 7 dictionaries in this ruleGroupList{} (as long as I don't change my WAF settings in AWS).

This is my search:

<search> |
| spath input=ruleGroupList{} path=excludedRules
| rename ruleGroupList{}.ruleGroupId as ruleGroup, ruleGroupList{}.excludedRules{}.ruleId as ruleGroupId, ruleGroupList{}.excludedRules as testNullExcludedRules
| eval x=case(!isnull(testNullExcludedRules),mvzip(ruleGroup,ruleGroupId),isnull(testNullExcludedRules),x)
| mvexpand x
| eval x = split(x,",")
| eval ruleGroupId=case(!isnull(testNullExcludedRules),mvindex(x,1))
| eval ruleGroup=case(!isnull(testNullExcludedRules),mvindex(x,0))
| table _time,ruleGroup,ruleGroupId

This gives me the ruleGroupId correctly, but it always lists the first instance of the ruleGroup:
Screen Shot 2021-10-27 at 4.53.43 PM.png
I can't figure out how to ignore the ruleGroup when it's corresponding excludedRules is NULL.

thanks for any help!

Kevin

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...