Splunk Search

How to concatenate fields from JSON

BeeSpark
Engager

I have an inputlookup table, in this lookup table there is a JSON array called "Evidence"

There is two field I would like to extract, one is "Rule" and the "Criticality". An example of Evidence array will look like this:

{"Evidence":[{"Rule":"Observed in the Wild Telemetry","Criticality":1},{"Rule":"Recent DDoS","Criticality":3}]}

So if I eval both "Rule" and Criticality" as shown below:

| eval "Rule"=spath(Evidence, "Evidence{}.Rule")
| eval "Criticality"=spath(Evidence, "Evidence{}.Criticality")
| table Rule Criticality

The output will show like this but the Rule & Criticality column doesn't separate into different row (it is all in one row):

Rule
Criticality
Observed in the Wild Telemetry
Recent DDoS
1
3


Now the tricky part, I would like display the top count of Rule (top Rule limit=10)  but at the same time display the associated Criticality with the Rule. How do it? since the above does not separate into different row.

The final outlook I am looking for, will look like this:

RuleCriticalityCount
Observed in the Wild Telemetry150
Recent DDoS32


An alternative I was thinking was using foreach then concate it into a Combined Field, but I think It is kind of complex.

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| spath Evidence{} output=Evidence
| mvexpand Evidence
| spath input=Evidence
| stats count by Rule Criticality

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| spath Evidence{} output=Evidence
| mvexpand Evidence
| spath input=Evidence
| stats count by Rule Criticality
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...