Splunk Search

search/subsearch using json array

a238574
Path Finder

I have logs being stored in json that shows accounts being given access to data. I need to validate that the accts are valid. I am trying to run a subsearch that will get the list of accounts(userId) from the logged event and validate against a list of known accts. I was planning on using a search/subsearch structure but I am having issues getting the acct list(userId) out of the json structure

json strusture -

eventID: 4321-4321-4321-1234
requestParameters: { [-]
     attributeType: CREATE_VOLUME_PERMISSION
     createVolumePermission: { [-]
       add: { [-]
         items: [ [-]
           { [-]
             userId: 1234567889
           }
           { [-]
             userId: 0987654321
           }
         ]
       }
     }

Ideally I would like to pass the eventId and userId to the main search for each userId and report those details if the acct is not found in my list of known accts

Tags (1)
0 Karma
1 Solution

a238574
Path Finder

I was able to get my query to work using the map function and mvexpand

View solution in original post

0 Karma

a238574
Path Finder

I was able to get my query to work using the map function and mvexpand

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!