Splunk Search

search/subsearch using json array

a238574
Path Finder

I have logs being stored in json that shows accounts being given access to data. I need to validate that the accts are valid. I am trying to run a subsearch that will get the list of accounts(userId) from the logged event and validate against a list of known accts. I was planning on using a search/subsearch structure but I am having issues getting the acct list(userId) out of the json structure

json strusture -

eventID: 4321-4321-4321-1234
requestParameters: { [-]
     attributeType: CREATE_VOLUME_PERMISSION
     createVolumePermission: { [-]
       add: { [-]
         items: [ [-]
           { [-]
             userId: 1234567889
           }
           { [-]
             userId: 0987654321
           }
         ]
       }
     }

Ideally I would like to pass the eventId and userId to the main search for each userId and report those details if the acct is not found in my list of known accts

Tags (1)
0 Karma
1 Solution

a238574
Path Finder

I was able to get my query to work using the map function and mvexpand

View solution in original post

0 Karma

a238574
Path Finder

I was able to get my query to work using the map function and mvexpand

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...