<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic spath error parsing data in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/spath-error-parsing-data/m-p/392939#M95353</link>
    <description>&lt;P&gt;Hi ,&lt;BR /&gt;
I have this issue when try to parse with json. For example i evaluate a field (for example) a_configuration : &lt;BR /&gt;
index="xxx" a_appl_id=YYY | &lt;BR /&gt;
| eval a_configuration="[[\"A1\",\"A2\"],[\"B1\",\"B2\"],[\"C1\",\"C2\"],[\"D1\",\"D2\"],[\"E1\",\"E2\"],[\"F1\",\"F2\"],[\"G1\",\"G2\"]]" &lt;BR /&gt;
| eval a_FieldX1=spath(a_configuration,"{0}{1}")&lt;BR /&gt;
| eval a_FieldX2=spath(a_configuration,"{1}{1}")&lt;BR /&gt;
| eval a_FieldX3=spath(a_configuration,"{2}{1}")&lt;BR /&gt;
| eval a_FieldX4=spath(a_configuration,"{3}{1}")&lt;BR /&gt;
| eval a_FieldX5=spath(a_configuration,"{4}{1}")&lt;BR /&gt;
| eval a_FieldX6=spath(a_configuration,"{5}{1}")&lt;BR /&gt;
| eval a_FieldX7=spath(a_configuration,"{6}{1}")&lt;BR /&gt;
| table a_configuration a_FieldX1 a_FieldX2 a_FieldX3 a_FieldX4 a_FieldX5 a_FieldX6 a_FieldX7&lt;BR /&gt;
the result expected is :&lt;BR /&gt;
&lt;IMG src="https://community.splunk.com/storage/temp/271775-repo1.jpg" alt="alt text" /&gt;&lt;BR /&gt;
but the result is :&lt;BR /&gt;
&lt;IMG src="https://community.splunk.com/storage/temp/271776-repo2.jpg" alt="alt text" /&gt;&lt;BR /&gt;
Can anyone teach me why ?&lt;BR /&gt;
Thanks to all ...&lt;/P&gt;</description>
    <pubDate>Tue, 29 Sep 2020 23:58:45 GMT</pubDate>
    <dc:creator>Marco_Andreis</dc:creator>
    <dc:date>2020-09-29T23:58:45Z</dc:date>
    <item>
      <title>spath error parsing data</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/spath-error-parsing-data/m-p/392939#M95353</link>
      <description>&lt;P&gt;Hi ,&lt;BR /&gt;
I have this issue when try to parse with json. For example i evaluate a field (for example) a_configuration : &lt;BR /&gt;
index="xxx" a_appl_id=YYY | &lt;BR /&gt;
| eval a_configuration="[[\"A1\",\"A2\"],[\"B1\",\"B2\"],[\"C1\",\"C2\"],[\"D1\",\"D2\"],[\"E1\",\"E2\"],[\"F1\",\"F2\"],[\"G1\",\"G2\"]]" &lt;BR /&gt;
| eval a_FieldX1=spath(a_configuration,"{0}{1}")&lt;BR /&gt;
| eval a_FieldX2=spath(a_configuration,"{1}{1}")&lt;BR /&gt;
| eval a_FieldX3=spath(a_configuration,"{2}{1}")&lt;BR /&gt;
| eval a_FieldX4=spath(a_configuration,"{3}{1}")&lt;BR /&gt;
| eval a_FieldX5=spath(a_configuration,"{4}{1}")&lt;BR /&gt;
| eval a_FieldX6=spath(a_configuration,"{5}{1}")&lt;BR /&gt;
| eval a_FieldX7=spath(a_configuration,"{6}{1}")&lt;BR /&gt;
| table a_configuration a_FieldX1 a_FieldX2 a_FieldX3 a_FieldX4 a_FieldX5 a_FieldX6 a_FieldX7&lt;BR /&gt;
the result expected is :&lt;BR /&gt;
&lt;IMG src="https://community.splunk.com/storage/temp/271775-repo1.jpg" alt="alt text" /&gt;&lt;BR /&gt;
but the result is :&lt;BR /&gt;
&lt;IMG src="https://community.splunk.com/storage/temp/271776-repo2.jpg" alt="alt text" /&gt;&lt;BR /&gt;
Can anyone teach me why ?&lt;BR /&gt;
Thanks to all ...&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 23:58:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/spath-error-parsing-data/m-p/392939#M95353</guid>
      <dc:creator>Marco_Andreis</dc:creator>
      <dc:date>2020-09-29T23:58:45Z</dc:date>
    </item>
    <item>
      <title>Re: spath error parsing data</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/spath-error-parsing-data/m-p/392940#M95354</link>
      <description>&lt;P&gt;@&lt;A href="mailto:Marco.Andreis@unicredit.eu"&gt;Marco.Andreis@unicredit.eu&lt;/A&gt; &lt;/P&gt;

&lt;P&gt;Can you please try this?&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults 
| eval a_configuration="[[\"A1\",\"A2\"],[\"B1\",\"B2\"],[\"C1\",\"C2\"],[\"D1\",\"D2\"],[\"E1\",\"E2\"],[\"F1\",\"F2\"],[\"G1\",\"G2\"]]"
| eval a_FieldX1=mvindex(spath(a_configuration,"{0}{}"),0)
| eval a_FieldX2=mvindex(spath(a_configuration,"{1}{}"),0)
| eval a_FieldX3=mvindex(spath(a_configuration,"{2}{}"),0)
| eval a_FieldX4=mvindex(spath(a_configuration,"{3}{}"),0)
| eval a_FieldX5=mvindex(spath(a_configuration,"{4}{}"),0)
| eval a_FieldX6=mvindex(spath(a_configuration,"{5}{}"),0)
| eval a_FieldX7=mvindex(spath(a_configuration,"{6}{}"),0)
| table a_configuration a_FieldX1 a_FieldX2 a_FieldX3 a_FieldX4 a_FieldX5 a_FieldX6 a_FieldX7
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Mon, 08 Apr 2019 13:35:19 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/spath-error-parsing-data/m-p/392940#M95354</guid>
      <dc:creator>kamlesh_vaghela</dc:creator>
      <dc:date>2019-04-08T13:35:19Z</dc:date>
    </item>
    <item>
      <title>Re: spath error parsing data</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/spath-error-parsing-data/m-p/392941#M95355</link>
      <description>&lt;P&gt;Thanks . With your syntax the result is what I'm expect. I haven't understand why in same fields are loaded more than one value , but yor command fix this issue.&lt;/P&gt;</description>
      <pubDate>Mon, 08 Apr 2019 14:20:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/spath-error-parsing-data/m-p/392941#M95355</guid>
      <dc:creator>Marco_Andreis</dc:creator>
      <dc:date>2019-04-08T14:20:11Z</dc:date>
    </item>
    <item>
      <title>Re: spath error parsing data</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/spath-error-parsing-data/m-p/392942#M95356</link>
      <description>&lt;P&gt;@&lt;A href="mailto:Marco.Andreis@unicredit.eu"&gt;Marco.Andreis@unicredit.eu&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;I'm also surprised about that. It should work. Well' I think your issue is resolved. So can you please accept this answer to close this question?&lt;/P&gt;</description>
      <pubDate>Tue, 09 Apr 2019 05:19:43 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/spath-error-parsing-data/m-p/392942#M95356</guid>
      <dc:creator>kamlesh_vaghela</dc:creator>
      <dc:date>2019-04-09T05:19:43Z</dc:date>
    </item>
  </channel>
</rss>

