Search code examples
splunksplunk-query

Splunk only select matching JSON data

I load JSON reports into Splunk and those reports have many arrays. When I search:

source=test| search "behavior.system.processes.process{}.fileactivities.fileCreated.call{}.path"="C:\\Windows*"

I often like to show the matching data. I use table to do so:

source=test| search "behavior.system.processes.process{}.fileactivities.fileCreated.call{}.path"="C:\\Windows*" | table "behavior.system.processes.process{}.fileactivities.fileCreated.call{}.path"

However, the issue is that this shows me all fileCreated of the matching event and not only the one starting with C:\Windows.

How do I filter that?

Solution

  • @joe-jeff

    I posted answer on answers.splunk.com. Please check below link.

    https://answers.splunk.com/answers/745093/only-select-matching-json-data.html