Splunk Search

unable to manipulate string from JSON (AWS CloudTrail)

ttovarzoll
Path Finder

I am trying to write a report of 'AccessDenied' messages in our AWS CloudTrail logs. These are in JSON format and the notable fields change depending on which service reports the error. So I am trying to simplify my results by comparing 2 fields:

  • errorMessage
  • requestParameters.Host

and keeping whichever one is populated, e.g.

 

sourcetype=aws:cloudtrail errorCode="AccessDenied"
| eval error = if( isnull(requestParameters.Host), errorMessage, requestParameters.Host)

 

But it doesn't work? I've traced it back to something weird with the "requestParameters.Host" field -- which is 'nested' inside the JSON. The other field, "errorMessage" works as expected and that's probably because it's a 'first-level' field in the JSON (not a secondary/nested field)

It's like the "requestParameters.Host" field isn't a string, e.g. the following search also fails

 

sourcetype=aws:cloudtrail errorCode="AccessDenied"
| eval test = requestParameters.Host

 

e.g. "test" is blank

------------------

I have also tried adding an "spath" command but I'm not sure how to use it. If I use the search UI's built-in "Add to search" it inserts:

 

sourcetype=aws:cloudtrail errorCode="AccessDenied" 
| spath "requestParameters.Host"
| eval error = if( isnull(requestParameters.Host), errorMessage, requestParameters.Host)

 

but that has no effect, i.e., "requestParameters.Host" is still a 'ghost' field which I cannot use in an 'eval' statement

Labels (2)
Tags (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

try enclosing the field name requestParameters.Host With single quote like below in if statement:

‘requestParameters.Host’

————————————
If this helps, give a like below.

View solution in original post

0 Karma

thambisetty
SplunkTrust
SplunkTrust

try enclosing the field name requestParameters.Host With single quote like below in if statement:

‘requestParameters.Host’

————————————
If this helps, give a like below.
0 Karma

ttovarzoll
Path Finder

Bah! It was as simple as that 🙂

I would have thought the single-quotes would be treating it as a string value, rather than the long-name of a variable.

0 Karma

thambisetty
SplunkTrust
SplunkTrust

double quotes for string. single quotes are used in eval command to identify field names if names contain space or any other special characters.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...