Splunk Search

unable to manipulate string from JSON (AWS CloudTrail)

ttovarzoll
Path Finder

I am trying to write a report of 'AccessDenied' messages in our AWS CloudTrail logs. These are in JSON format and the notable fields change depending on which service reports the error. So I am trying to simplify my results by comparing 2 fields:

  • errorMessage
  • requestParameters.Host

and keeping whichever one is populated, e.g.

 

sourcetype=aws:cloudtrail errorCode="AccessDenied"
| eval error = if( isnull(requestParameters.Host), errorMessage, requestParameters.Host)

 

But it doesn't work? I've traced it back to something weird with the "requestParameters.Host" field -- which is 'nested' inside the JSON. The other field, "errorMessage" works as expected and that's probably because it's a 'first-level' field in the JSON (not a secondary/nested field)

It's like the "requestParameters.Host" field isn't a string, e.g. the following search also fails

 

sourcetype=aws:cloudtrail errorCode="AccessDenied"
| eval test = requestParameters.Host

 

e.g. "test" is blank

------------------

I have also tried adding an "spath" command but I'm not sure how to use it. If I use the search UI's built-in "Add to search" it inserts:

 

sourcetype=aws:cloudtrail errorCode="AccessDenied" 
| spath "requestParameters.Host"
| eval error = if( isnull(requestParameters.Host), errorMessage, requestParameters.Host)

 

but that has no effect, i.e., "requestParameters.Host" is still a 'ghost' field which I cannot use in an 'eval' statement

Labels (2)
Tags (2)
0 Karma
1 Solution

thambisetty
Super Champion

try enclosing the field name requestParameters.Host With single quote like below in if statement:

‘requestParameters.Host’

————————————
If this helps, give a like below.

View solution in original post

0 Karma

thambisetty
Super Champion

try enclosing the field name requestParameters.Host With single quote like below in if statement:

‘requestParameters.Host’

————————————
If this helps, give a like below.
0 Karma

ttovarzoll
Path Finder

Bah! It was as simple as that 🙂

I would have thought the single-quotes would be treating it as a string value, rather than the long-name of a variable.

0 Karma

thambisetty
Super Champion

double quotes for string. single quotes are used in eval command to identify field names if names contain space or any other special characters.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...