Splunk Search

unable to manipulate string from JSON (AWS CloudTrail)

ttovarzoll
Path Finder

I am trying to write a report of 'AccessDenied' messages in our AWS CloudTrail logs. These are in JSON format and the notable fields change depending on which service reports the error. So I am trying to simplify my results by comparing 2 fields:

  • errorMessage
  • requestParameters.Host

and keeping whichever one is populated, e.g.

 

sourcetype=aws:cloudtrail errorCode="AccessDenied"
| eval error = if( isnull(requestParameters.Host), errorMessage, requestParameters.Host)

 

But it doesn't work? I've traced it back to something weird with the "requestParameters.Host" field -- which is 'nested' inside the JSON. The other field, "errorMessage" works as expected and that's probably because it's a 'first-level' field in the JSON (not a secondary/nested field)

It's like the "requestParameters.Host" field isn't a string, e.g. the following search also fails

 

sourcetype=aws:cloudtrail errorCode="AccessDenied"
| eval test = requestParameters.Host

 

e.g. "test" is blank

------------------

I have also tried adding an "spath" command but I'm not sure how to use it. If I use the search UI's built-in "Add to search" it inserts:

 

sourcetype=aws:cloudtrail errorCode="AccessDenied" 
| spath "requestParameters.Host"
| eval error = if( isnull(requestParameters.Host), errorMessage, requestParameters.Host)

 

but that has no effect, i.e., "requestParameters.Host" is still a 'ghost' field which I cannot use in an 'eval' statement

Labels (2)
Tags (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

try enclosing the field name requestParameters.Host With single quote like below in if statement:

‘requestParameters.Host’

————————————
If this helps, give a like below.

View solution in original post

0 Karma

thambisetty
SplunkTrust
SplunkTrust

try enclosing the field name requestParameters.Host With single quote like below in if statement:

‘requestParameters.Host’

————————————
If this helps, give a like below.
0 Karma

ttovarzoll
Path Finder

Bah! It was as simple as that 🙂

I would have thought the single-quotes would be treating it as a string value, rather than the long-name of a variable.

0 Karma

thambisetty
SplunkTrust
SplunkTrust

double quotes for string. single quotes are used in eval command to identify field names if names contain space or any other special characters.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...