About btsr

btsr · ‎04-19-2023

I think we need to get the msg.object and replace all HTML codes to double quotes on the fly to make a valid JSON before querying further. { "app": "mock-app", "sessionId": "71cde99f-faa9-47df-99d4-97b81b39275b", "msg": { "event": "response", "status": "success", "details": [ { "key": "key1", "value": "value1" } ], "method": "post", "object":{ \u0026#34;headers\u0026#34;: { \u0026#34;content-length\u0026#34;: \u0026#34;225\u0026#34;, \u0026#34;requestType\u0026#34;: \u0026#34;basic\u0026#34; }, \u0026#34;body\u0026#34;: { \\\u0026#34;client\\\u0026#34;: { \\\u0026#34;clientName\\\u0026#34;: \\\u0026#34;XyzClient\\\u0026#34; }, \\\u0026#34;order\\\u0026#34;: { \\\u0026#34;number\\\u0026#34;: \\\u0026#34;551270009\\\u0026#34;, \\\u0026#34;details\\\u0026#34;: [ { \\\u0026#34;item\\\u0026#34;: \\\u0026#34;product\\\u0026#34;, \\\u0026#34;address\\\u0026#34;: { \\\u0026#34;street\\\u0026#34;: \\\u0026#34;Main St\\\u0026#34;, \\\u0026#34;zip\\\u0026#34;: \\\u0026#34;12345\\\u0026#34;, \\\u0026#34;state\\\u0026#34;: \\\u0026#34;MN\u0026#34;, \\\u0026#34;city\\\u0026#34;: \\\u0026#34;XyzCity\\\u0026#34; } } ] } } } } }

btsr · ‎04-19-2023

Thanks @yeahnah, the msg.object field is ingested with HTML code like shown in the screenshot by the Splunk team to allow different teams to use it for different free form JSON format. If I click on "Show as Raw Text" in Splunk, it is replacing all ampersand symbol with \u0026

btsr · ‎04-19-2023

Hi, I need some help with querying log events based on field values nested inside a escaped raw JSON object property. Below screenshot represents the complete JSON log event in "Show syntax highlighted" mode. I need to filter events based on properties in the parent JSON object and also combine field values from msg.object which is also a proper JSON object. I tried rex, spath but couldn't filter the events the way I need. Any help is appreciated. Thanks. I am looking for a query to filter events matching the highlighted fields in the Splunk event log screenshot. This is for a dashboard with dropdowns for app, clientName, requestType, and state fields. I should be able to filter the log events based on dropdown selection. index=x05_dev app=mock-app msg.detail{}.value=value1 | search msg.object.headers.requestType="basic" | search msg.object.body.client.clientName="XyzClient" | search msg.object.body.order.details[*].address.state="MN" Sample Splunk Log Event

btsr · ‎02-09-2023

Hi All, Our JSON payload looks like as shown below. The msg.details array can have any number key/value pairs in any order. { "appName": "TestApp", "eventType": "Response", "msg": { "transId": "Trans1234", "status": "Success", "client": "clientXyz", "responseTime": 1650, "details": [ { "keyName": "returnUrl", "keyValue": "https://abc.com/onlineshop?prod=112&cat=1349" }, { "keyName": "customer", "keyValue": "xyz" } ], "url": "/v1/test" } } I want to filter events using partial wildcard keyValue for a keyName in the array in the msg.details array. Your help is appreciated. Thanks. index=* appName="TestApp" msg.url="/v1/test" | spath | search msg.details{}.keyName=returnUrl AND msg.details{}.keyValue!="*abc.com*" The search may include multiple keyValue filters in the array like this. Thanks. index=* appName="TestApp" msg.url="/v1/test" | spath | search (msg.details{}.keyName=customer AND msg.details{}.keyValue!="xyz") AND (msg.details{}.keyName=returnUrl AND msg.details{}.keyValue!="*abc.com*")

btsr · ‎02-07-2023

This saved my day! Thank you @ITWhisperer!

btsr · ‎02-06-2023

Hi All, I don't have much experience with Splunk. My JSON payload looks like as shown below. The msg.details array can have any number key/value pairs in any order. { "appName": "TestApp", "eventType": "Response", "msg": { "transId": "Trans1234", "status": "Success", "client": "clientXyz", "responseTime": 1650, "details": [ { "keyName": "rtt", "keyValue": 2778 }, { "keyName": "trace", "keyValue": 97007839130680 } ], "url": "/v1/test" } } I am trying to write a query and form a table as shown below. I am interested in displaying only the keyValue of keyName:trace in the table. Any help is appreciated. Thanks. index=* appName="TestApp" msg.url="/v1/test" | table msg.transId, msg.status, msg.details[keyName="trace"].keyValue msg.transId msg.status msg.details[keyName="trace"].keyValue Trans1234 Success 97007839130680 Trans7890 ERROR 29411645500355

Posts	7
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎02-06-2023

Online Status	Offline
Date Last Visited	‎04-24-2023 01:39 PM

Querying log events based on field values nested i...

How to exclude or select events based on value fro...

How to get specific value from key/value array to ...

Re: Querying log events based on field values nest...

Re: Querying log events based on field values nest...

Querying log events based on field values nested i...

How to exclude or select events based on value fro...

Re: How to get specific value from key/value array...

How to get specific value from key/value array to ...