Why is spath returning duplicate value for fields?

indeed_2000 — Tue, 20 Jun 2023 02:42:20 GMT

Hi I'm trying to use spath to break doen json log, but it duplicates these two fields "time" and "@timestamp" when I create a table! While raw logs show fields that contain only one timestamp!

Here is my query:

index="myindex" | spath input=_raw | dedup time | table time _time @timestamp _raw

Here is output:

time                                                       _time                              @timestamp
2023-06-16T12:27:54.907Z        2023-06-18 15:55:30         2023-06-18T12:23:01.109495047Z
2023-06-16T12:27:54.907Z                                                              2023-06-18T12:23:01.109495047Z

here is raw log:

_raw
{"server":"mysrv","tags":["_dateparsefailure"],"results":{"statement_id":0},"uniq":"026","@timestamp":"2023-06-18T12:23:01.109495047Z","@version":"1","success":"true","type":"in","http_poller_metadata":{"input":{"http_poller":{"response":{"status_code":200,"headers":{"date":"Sun, 18 Jun 2023 12:27:54 GMT","x-influxdb-build":"OSS","x-request-id":"8cae1609-0dd3-11ee-8ace-005056b7dda2","request-id":"8cae1609-0dd3-11ee-8ace-005056b7dda2","x-influxdb-version":"1.7.8","transfer-encoding":"chunked","content-type":"application/json"},"elapsed_time_ns":4031,"status_message":"OK"},"request":{"retry_count":0,"name":"cpu","host":{"hostname":"logsrv"},"original":{"url":"https://192.168.1.1:8086/query?pretty=true&db=mydb&q=SELECT%20*%20FROM%20%22msg%22%20WHERE%20time%20%3E%20now()%20-%202d%20limit%203600","headers":{"Authorization":"Token mytoken"},"method":"get"}}}}},"time":"2023-06-16T12:27:54.907Z","name":"msg","count":1,"connectionname":"myconnection"}

Re: spath return duplicate value for fields

ITWhisperer — Mon, 19 Jun 2023 06:37:29 GMT

The commands and sample you provided do not produce the result you provided, so something else may be going on. Please provide more details and examples demonstrating this issue.

topic Why is spath returning duplicate value for fields? in Getting Data In

Why is spath returning duplicate value for fields?

Re: spath return duplicate value for fields