Splunk only select matching JSON data

0
votes

I load JSON reports into Splunk and those reports have many arrays. When I search:

source=test| search "behavior.system.processes.process{}.fileactivities.fileCreated.call{}.path"="C:\\Windows*"

I often like to show the matching data. I use table to do so:

source=test| search "behavior.system.processes.process{}.fileactivities.fileCreated.call{}.path"="C:\\Windows*" | table "behavior.system.processes.process{}.fileactivities.fileCreated.call{}.path"

However, the issue is that this shows me all fileCreated of the matching event and not only the one starting with C:\Windows.

How do I filter that?

1
splunksplunk-query

1 Answers

0
votes

@joe-jeff

I posted answer on answers.splunk.com. Please check below link.

https://answers.splunk.com/answers/745093/only-select-matching-json-data.html