Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to search in a JSON array of hashes?

$
0
0
I have a JSON entry as follows: { [-] name: change_user_access parameters: [ [-] { [+] } { [-] name: target_user value: me@corp.com } { [+] } { [+] } { [-] name: owner value: peter@corp.com } { [+] } { [+] } { [+] } ] I'm trying to find a way to get only those events where: - name == "change_user_access" - owner == "*@corp.com" - target_user != "*@corp.com" The problem is that I don't know how to request something like: 'if name="owner" and value="*@corp.com" in the same hash'. Any ideas?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>