topic Spath key with period in it in Splunk Search

Spath key with period in it

mrstrozy — Fri, 25 Jan 2019 00:46:38 GMT

Hi All,

I am dealing with a key that has a period in it. I am trying to figure out how to use spath to extract it but I haven't had any luck. Here is an example of what the data would look like:

Event:

apples: {
granny.smith: {
color: "green",
crunchy: "true"
}
}

In this case I would like to extract "granny.smith" as a field but I am unable to.

Any help would be much appreciated.

Thanks!

Re: Spath key with period in it

niketn — Fri, 25 Jan 2019 02:45:57 GMT

@mrstrozy do you need granny.smith as a field? It will have a nested JSON in it. Actual fields would be granny.smith.color with value green as per your data. This should work out of the box. Following is an example based on sample data provided:

| makeresults
| eval _raw="{
    \"apples\": {
        \"granny.smith\": {
                \"color\": \"green\",
                \"crunchy\": \"true\"
            }
        }
    }"
| spath

Re: Spath key with period in it

hcanivel_splunk — Tue, 29 Jan 2019 08:51:41 GMT

First of all, I don't think the formatting is correct. Your field of granny.smith should certainly be wrapped by quotes to be read properly (try double quotes). I would recommend using any sort of coding library to help do this for you. But, even if the event data was printed in a proper format, you'd need to extract your fields somehow.

I would recommend either of two solutions, presuming your event data is completely in JSON format:

Create a custom sourcetype props stanza and specify for KV mode to JSON:

[sourcetype]
KV_MODE = json

Preferred format as this search extraction will extract for fields from the JSON data consistently reducing need to append to every search query manually
Reference: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Exampleconfigurationsusingfieldtransforms

Use spath command within your search

*SPL* | spath

This command will pull from the _raw field by default, but you can specify any other field
Reference: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath

Either way, once you have those fields, how you can reference these fields thereafter, you'll need to use single quotes for any sort of calculated field manipulation. In your case, if if the fields were indeed extracted and you wanted to search against it, here's an SPL query sample:

index=main 'granny.apple.color' != "green"

Give that a shot.