Splunk Search

How to concatenate fields from JSON

BeeSpark
Engager

I have an inputlookup table, in this lookup table there is a JSON array called "Evidence"

There is two field I would like to extract, one is "Rule" and the "Criticality". An example of Evidence array will look like this:

{"Evidence":[{"Rule":"Observed in the Wild Telemetry","Criticality":1},{"Rule":"Recent DDoS","Criticality":3}]}

So if I eval both "Rule" and Criticality" as shown below:

| eval "Rule"=spath(Evidence, "Evidence{}.Rule")
| eval "Criticality"=spath(Evidence, "Evidence{}.Criticality")
| table Rule Criticality

The output will show like this but the Rule & Criticality column doesn't separate into different row (it is all in one row):

Rule
Criticality
Observed in the Wild Telemetry
Recent DDoS
1
3


Now the tricky part, I would like display the top count of Rule (top Rule limit=10)  but at the same time display the associated Criticality with the Rule. How do it? since the above does not separate into different row.

The final outlook I am looking for, will look like this:

RuleCriticalityCount
Observed in the Wild Telemetry150
Recent DDoS32


An alternative I was thinking was using foreach then concate it into a Combined Field, but I think It is kind of complex.

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| spath Evidence{} output=Evidence
| mvexpand Evidence
| spath input=Evidence
| stats count by Rule Criticality

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| spath Evidence{} output=Evidence
| mvexpand Evidence
| spath input=Evidence
| stats count by Rule Criticality
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...