topic Re: Work with fieldnames that contains {}. +PRTG in Splunk Enterprise https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/554065#M5970 Hi<BR />as your event is json, you should try spath with it.<BR />r. Ismo Wed, 02 Jun 2021 08:19:25 GMT isoutamo 2021-06-02T08:19:25Z Work with fieldnames that contains {}. +PRTG https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/553833#M5958 <P>Hi,</P><P>I'm using the PRTG app to get logs from this monitoring tool and build clean reports about our servers health.</P><P>The API is returning a JSON and the automatic field extraction gets fields like&nbsp;sensors{}.sensor.</P><P>How could I build a query referencing to this fields? If I try something like this fails:</P><P>index=prtg "sensors{}.sensor"=Ping</P><P>Thanks</P> Tue, 01 Jun 2021 11:09:17 GMT https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/553833#M5958 maaneeel 2021-06-01T11:09:17Z Re: Work with fieldnames that contains {}. +PRTG https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/553837#M5959 <P>Try with single quotes not double</P><P><SPAN>index=prtg 'sensors{}.sensor'=Ping</SPAN></P> Tue, 01 Jun 2021 11:50:09 GMT https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/553837#M5959 ITWhisperer 2021-06-01T11:50:09Z Re: Work with fieldnames that contains {}. +PRTG https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/553976#M5961 Exactly that way. Usually single quote means field and double means value (of field). Tue, 01 Jun 2021 21:22:32 GMT https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/553976#M5961 isoutamo 2021-06-01T21:22:32Z Re: Work with fieldnames that contains {}. +PRTG https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/554054#M5968 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="splunk_query.png" style="width: 713px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14430i648DE9D3CDB3A242/image-size/large?v=v2&amp;px=999" role="button" title="splunk_query.png" alt="splunk_query.png" /></span></P><P>Hello again, It's not working,</P><P>Thanks for your help</P><P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/214410">@isoutamo</a>&nbsp;</P> Wed, 02 Jun 2021 07:13:57 GMT https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/554054#M5968 maaneeel 2021-06-02T07:13:57Z Re: Work with fieldnames that contains {}. +PRTG https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/554056#M5969 <P class="lia-align-left">I also tried use eval and filter by the new result without success</P><P class="lia-align-left">&nbsp;</P><P class="lia-align-left"><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="eval.png" style="width: 801px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14431i22EA5BBC4943757E/image-size/large?v=v2&amp;px=999" role="button" title="eval.png" alt="eval.png" /></span></P> Wed, 02 Jun 2021 07:20:36 GMT https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/554056#M5969 maaneeel 2021-06-02T07:20:36Z Re: Work with fieldnames that contains {}. +PRTG https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/554065#M5970 Hi<BR />as your event is json, you should try spath with it.<BR />r. Ismo Wed, 02 Jun 2021 08:19:25 GMT https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/554065#M5970 isoutamo 2021-06-02T08:19:25Z Re: Work with fieldnames that contains {}. +PRTG https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/554078#M5973 <P>It looks like sensors{}.sensor is a multi-value field - try extracting the collection (spath) and separate each element into different events (mvexpand), then extract the fields you are interested in (spath again).</P> Wed, 02 Jun 2021 09:42:59 GMT https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/554078#M5973 ITWhisperer 2021-06-02T09:42:59Z Re: Work with fieldnames that contains {}. +PRTG https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/554083#M5974 <P>Thanks</P><P>&nbsp;</P><P>I didn't know spath command, but after try it I have the same problem with the new field...</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="spath.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14434iF36DCC0760BAC38E/image-size/large?v=v2&amp;px=999" role="button" title="spath.png" alt="spath.png" /></span></P><P>Any idea?</P><P>Thanks</P> Wed, 02 Jun 2021 10:15:29 GMT https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/554083#M5974 maaneeel 2021-06-02T10:15:29Z Re: Work with fieldnames that contains {}. +PRTG https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/554086#M5975 <LI-CODE lang="markup">index=prtg | spath output=sensors path=sensors{} | mvexpand sensors | search Ping | spath input=sensors</LI-CODE> Wed, 02 Jun 2021 10:54:05 GMT https://community.splunk.com/t5/Splunk-Enterprise/Work-with-fieldnames-that-contains-PRTG/m-p/554086#M5975 ITWhisperer 2021-06-02T10:54:05Z