Splunk Search

mvexpand multi-value fields when not null

khenson
Engager

Hi all.  I'm trying to create a table from AWS WAF logs.  There is a section of the log that is called ruleGroupList{} and it is a list containing multiple dictionaries.  Sometimes there is field called "excludedRules" that is null.  When it is not null, it is a list containing a dictionary with a field called ruleId.

   ruleGroupList: [ [-]
     { [-]
       excludedRulesnull
       nonTerminatingMatchingRules: [ [+]
       ]

       ruleGroupIdAWS#AWSManagedRulesBotControlRuleSet
       terminatingRulenull
     }
     { [-]
       excludedRules: [ [-]
         { [-]
           exclusionTypeEXCLUDED_AS_COUNT
           ruleIdSizeRestrictions_BODY
         }
       ]

       nonTerminatingMatchingRules: [ [+]
       ]

       ruleGroupIdAWS#AWSManagedRulesCommonRuleSet
       terminatingRulenull
     }

In this case, I want to:

list the ruleGroupList{}.ruleGroupId and the ruleGroupList{}.excludedRules{}.ruleId in a table,
when ruleGroupList{}.excludedRules is not NULL. 

If it is NULL, then I don't want to display the values for that dictionary.  There are 7 dictionaries in this ruleGroupList{} (as long as I don't change my WAF settings in AWS).

This is my search:

<search> |
| spath input=ruleGroupList{} path=excludedRules
| rename ruleGroupList{}.ruleGroupId as ruleGroup, ruleGroupList{}.excludedRules{}.ruleId as ruleGroupId, ruleGroupList{}.excludedRules as testNullExcludedRules
| eval x=case(!isnull(testNullExcludedRules),mvzip(ruleGroup,ruleGroupId),isnull(testNullExcludedRules),x)
| mvexpand x
| eval x = split(x,",")
| eval ruleGroupId=case(!isnull(testNullExcludedRules),mvindex(x,1))
| eval ruleGroup=case(!isnull(testNullExcludedRules),mvindex(x,0))
| table _time,ruleGroup,ruleGroupId

This gives me the ruleGroupId correctly, but it always lists the first instance of the ruleGroup:
Screen Shot 2021-10-27 at 4.53.43 PM.png
I can't figure out how to ignore the ruleGroup when it's corresponding excludedRules is NULL.

thanks for any help!

Kevin

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...