Splunk Search

Can I index into array in my search to pull two specific displayName and result values out and use stats command?

meliaolsen
New Member

Hello folks,

I'm trying to write a drill-down search for a correlation search in Enterprise Security, and I'm having trouble extracting/accessing a field in my event. Each event has a collection of conditional access policies stored in an array, with each value in the array being a collection of key-value pairs. With syntax highlighted, it looks like this (with some policies not expanded): 

meliaolsen_0-1656523986715.png

Here's what it looks like in the raw text: 

 

 

 

"appliedConditionalAccessPolicies": [{"id": "xxx", "displayName": "xxx", "enforcedGrantControls": [], "enforcedSessionControls": [], "result": "notEnabled"}, {"id": "xxx", "displayName": "xxx", "enforcedGrantControls": ["Mfa"], "enforcedSessionControls": ["CloudAppSecurity"], "result": "notApplied"}, {"id": "xxx", "displayName": "xxx", "enforcedGrantControls": ["RequireApprovedApp"], "enforcedSessionControls": [], "result": "notApplied"}, ...]

 

 

 

 

We've extracted the fields:

  • appliedConditionalAccessPolicies{}.displayName
  • appliedConditionalAccessPolicies{}.enforcedGrantControls
  • appliedConditionalAccessPolicies{}.enforcedSessionControls
  • appliedConditionalAccessPolicies{}.id
  • appliedConditionalAccessPolicies{}.result

However, because we have 13 different policies in the appliedConditionalAccessPolicies array, every event contains every possible value of each of these fields. We don't have a way to associate values from the same index of the array together. Many of these policies are tests, which I don't care about. I really only care about two of them, and I would like to find a way to access at least the displayName and result of only those two policies. It would also be nice to access the enforcedGrantControls and enforcedSessionControls of the policies, but those are less critical to my search.

Is there a way I can index into this array in my search to pull two specific displayName and result values out and use them, for example with a stats command?

Thanks in advance for your help!

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try extracting the array objects, then use mvexpand to create separate event, then extract the part of the object you want

| spath appliedConditionalAccessPolicies{} output=appliedConditionalAccessPolicies
| mvexpand appliedConditionalAccessPolicies
| spath input=appliedConditionalAccessPolicies displayName
| spath input=appliedConditionalAccessPolicies enforcedGrantControls{}
| spath input=appliedConditionalAccessPolicies enforcedSessionControls{}
| spath input=appliedConditionalAccessPolicies id
| spath input=appliedConditionalAccessPolicies result
0 Karma

meliaolsen
New Member

Thanks for your response!

I've tried implementing your suggestion, but I'm still not fully understanding how mvexpand and spath work. (I'm relatively new to SPL.) Where do the array objects and new events go after I've extracted them?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...