topic Spath for getting date json field in Getting Data In

Spath for getting date json field

splkdylb — Thu, 14 Nov 2019 14:23:48 GMT

Hi all,

I'm trying to use spath to extract JSON data from a field name that represents a date:

{
"field1": {
"2019-01-02": []
}
}

but when I try spath input=message output=result field1.2019-01-02 it's not working. I tried to replace the field name with another text (i.e. replace "2019-02-01" with "targetDate") and setting the replaced result in the spath input parameter but it is still not working.

Thank you for your help.

Re: Spath for getting date json field

woodcock — Fri, 15 Nov 2019 01:22:18 GMT

Show us an entire raw event.

Re: Spath for getting date json field

anantcd — Fri, 15 Nov 2019 02:59:48 GMT

Try this SPL:

| makeresults 
| eval message="{\"foo\":{\"2019-01-02\":[{\"zoo\":1},{\"baz\":2}]}}" 
| spath input=message output=result path=foo.2019-01-02{}