Splunk Search

How to search against multiple elements

47024
New Member

I'm trying to capture occurrences when multiple criteria are true in an event where elements can exist multiple times in the message.

For example, with the below event I want to capture how often events have an element that is both id=A and width>600.

Because there are multiple walls I can easily filter when any element has an id=A or a width>600, but I cannot figure out how to filter where both criteria are met.

Example message below:

elements: [
   {
      id: A
      width: 585
   }
   {
      id: B
      width: 605
   }
]
0 Karma
1 Solution

aberkow
Builder

You can either leverage the spath command https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Spath to make the data easier to work with, or look at the answer posted here: https://answers.splunk.com/answers/784418/dynamic-loop-through-a-json-array-looking-for-trig.html#an...

Essentially, you need to create a pairing between id and width, separate them into their own rows, index them out, and then run your search:

{code}
your_base_search
| eval id_zip_width=mvzip(id,width)
| mvexpand id_zip_width
| eval id_zip_width=split(id_zip_width,",")
| eval id=mvindex(id_zip_width,0)
| eval width=mvindex(id_zip_width,1)
| search id="A" and width>600
{code}

Hope this helps!

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

... | eval _raw = mvzip(id, width, "=")
| kv
| where A>600
0 Karma

aberkow
Builder

You can either leverage the spath command https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Spath to make the data easier to work with, or look at the answer posted here: https://answers.splunk.com/answers/784418/dynamic-loop-through-a-json-array-looking-for-trig.html#an...

Essentially, you need to create a pairing between id and width, separate them into their own rows, index them out, and then run your search:

{code}
your_base_search
| eval id_zip_width=mvzip(id,width)
| mvexpand id_zip_width
| eval id_zip_width=split(id_zip_width,",")
| eval id=mvindex(id_zip_width,0)
| eval width=mvindex(id_zip_width,1)
| search id="A" and width>600
{code}

Hope this helps!

0 Karma

47024
New Member

This worked! Thank you very much.

0 Karma

woodcock
Esteemed Legend

Be sure to try mine; it should scale better and is much shorter.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...