Splunk Search

search/subsearch using json array

a238574
Path Finder

I have logs being stored in json that shows accounts being given access to data. I need to validate that the accts are valid. I am trying to run a subsearch that will get the list of accounts(userId) from the logged event and validate against a list of known accts. I was planning on using a search/subsearch structure but I am having issues getting the acct list(userId) out of the json structure

json strusture -

eventID: 4321-4321-4321-1234
requestParameters: { [-]
     attributeType: CREATE_VOLUME_PERMISSION
     createVolumePermission: { [-]
       add: { [-]
         items: [ [-]
           { [-]
             userId: 1234567889
           }
           { [-]
             userId: 0987654321
           }
         ]
       }
     }

Ideally I would like to pass the eventId and userId to the main search for each userId and report those details if the acct is not found in my list of known accts

Tags (1)
0 Karma
1 Solution

a238574
Path Finder

I was able to get my query to work using the map function and mvexpand

View solution in original post

0 Karma

a238574
Path Finder

I was able to get my query to work using the map function and mvexpand

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...