topic Re: Removing Single Fields From a List of Maps in Splunk Search

Removing Single Fields From a List of Maps

steeleverint — Fri, 19 Feb 2021 22:57:45 GMT

Hi,

I have an event json similar to:

{"stages":[{"duration":12,"status":"Success","children":[{"test":"integration","result":"passed"},{"test":"regression","result":"failed"}]},{"duration":1.5,"status":"Success","children":[{"test":"unit","result":"passed"},{"test":"regression","result":"passed"}]},{"duration":3.1,"status":"Success","children":[{"test":"integration","result":"passed"},{"test":"unit","result":"failed"}]}]}

where children is a list of maps inside a list of maps. The problem is that this list is so large that it exceeds the 10000 character limit. I don't have admin access so cannot increase this limit. What I would like to is remove the children field inside of each map in the stages list. I've tried numerous attempts without any luck. Anyone know of a way to do this?

Thanks

Re: Removing Single Fields From a List of Maps

to4kawa — Sat, 20 Feb 2021 01:58:27 GMT

index=_internal | head 1 |fields _raw | eval _raw="{\"stages\":[{\"duration\":12,\"status\":\"Success\",\"children\":[{\"test\":\"integration\",\"result\":\"passed\"},{\"test\":\"regression\",\"result\":\"failed\"}]},{\"duration\":1.5,\"status\":\"Success\",\"children\":[{\"test\":\"unit\",\"result\":\"passed\"},{\"test\":\"regression\",\"result\":\"passed\"}]},{\"duration\":3.1,\"status\":\"Success\",\"children\":[{\"test\":\"integration\",\"result\":\"passed\"},{\"test\":\"unit\",\"result\":\"failed\"}]}]}" | spath stages{} output=stages | stats count by stages | streamstats count as session | spath input=stages children{} output=child | spath input=stages duration | spath input=stages status | stats values(duration) as duration values(status) as status by session child | spath input=child | fields - session child

You can make a table with it.

If you want to delete it, try this.

Re: Removing Single Fields From a List of Maps

steeleverint — Mon, 22 Feb 2021 23:36:14 GMT

Thanks. That did the trick. Just did a slight modification to remove the field altogether:

rex mode=sed "s/\"children\":\[.*?\],//g"