About mayurkale471757

mayurkale471757 · ‎02-05-2024

Thanks @yuanliu this is what I was looking for great !!

mayurkale471757 · ‎02-02-2024

It is producting below result , I want to read the x and y field | makeresults count=1 | eval json_data="{\"data\": {\"a\": {\"x\": {\"mock_x_field\": \"value_x\"}, \"y\": {\"mock_y_field\": \"value_y\"}}}}" | append [ makeresults count=1 | eval json_data="{\"data\": {\"b\": {\"x\": {\"mock_x_field\": \"value_x\"}, \"y\": {\"mock_y_field\": \"value_y\"}}}}" ] | append [ makeresults count=1 | eval json_data="{\"data\": {\"c\": {\"x\": {\"mock_x_field\": \"value_x\"}, \"y\": {\"mock_y_field\": \"value_y\"}}}}" ] | append [ makeresults count=1 | eval json_data="{\"data\": {\"d\": {\"x\": {\"mock_x_field\": \"value_x\"}, \"y\": {\"mock_y_field\": \"value_y\"}}}}" ] | spath | fields - _raw | transpose 0 column_name=field | eval field=mvindex(split(field,"."),0).".".mvindex(split(field,"."),2).".".mvindex(split(field,"."),3) | transpose 0 header_field=field | fields - column

mayurkale471757 · ‎02-02-2024

Hi Team I have the below Json string coming as an event in Splunk logs . after data, the next field could be a, b, c, d I want to read the x and y fields, How to write a single spath query like | spath input=inputJson path="data.{*}.x" {data : {a : { x: { } y: { }}} } {data : {b : { x: { } y: { }}} } {data : {c : { x: { } y: { }}} } {data : {d : { x: { } y: { }}} }

mayurkale471757 · ‎12-04-2023

Thanks Guys, changing the settings at HF solved this issue

mayurkale471757 · ‎11-29-2023

Hi Team, I came across an issue where I have below sample logs in a file 15:30:31.396|Info|Response ErrorMessage: || 15:30:36.610|Info|Logging Rest Client Request...|| 15:30:36.610|Info|Request Uri: https://abc-domain/api/xy/Identify|| 15:30:36.694|Info|Logging Rest Client Response...|| 15:30:36.694|Info|Response Status Code: 401|| 15:30:36.710|Info|Response Status Description: Unauthorized|| 15:30:36.741|Info|Response Content: || 15:30:36.741|Info|Response ErrorMessage: || 15:30:36.762|Info|Logging Rest Client Request...|| I am using splunk forwarder version splunkforwarder-8.2.4-87e2dda940d1-x64-release with below prop.conf settings [xyz:mnl] LB_CHUNK_BREAKER = ([\r\n]+) On splunk portal I am not getting one line as a one event instead I am getting multiple lines as a single event like below

mayurkale471757 · ‎05-24-2022

Hi Team, I have below JSON structure data.searchByUserName.customerDetails.... data.searchByLastName.customerDetails.... data.searchByUUID.customerDetails.... data.searchByDOB.customerDetails.... While creating a search query I need to give the search type highlighted above in bold wild char like data.*.customerDetails is there any way I can achieve it? Thanks in Advance!

Posts	6
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎05-24-2022

Online Status	Offline
Date Last Visited	‎02-05-2024 02:21 AM

How to use spath to read dynamic path

Splunkforwarder pushes multiple lines as single ev...

How to add Dynamic Json path addition in splunk qu...

Re: How to use spath to read dynamic path

Re: How to use spath to read dynamic path

How to use spath to read dynamic path

Re: Splunkforwarder pushes multiple lines as singl...

Splunkforwarder pushes multiple lines as single ev...

How to add Dynamic Json path addition in splunk qu...