topic Re: Issue with point separator, after conversion from a json file in Splunk Search

Issue with point separator, after conversion from a json file

timo258 — Thu, 23 Jun 2022 16:21:49 GMT

Hi together!

I have an issue with the point separator, after conversion from a json file.

This is raw json:

"customfield_26202" : { "self" : "link", "value" : "Software: Softwareentwicklung und Product Security", "id" : "30705", "disabled" : false, "child" : { "self" : "link", "value" : "Software-Projektleiter", "id" : "30771", "disabled" : false

Splunk extracts the field: customfield_26202.child.value="Software-Projektleiter" (Done with _json sourcetype)

Now I want to merge to fields like this:

| eval output = mvappend(customfield_26202.child.value, customfield_26204.child.value)
| mvexpand output
| table output

When I do exactly the same thing without .child.value everything works fine.

I tried it with several quotation marks (", ' etc.) nothing helps.

Any idea what I do wrong? Thank you!

Timo

Re: Issue with point separator, after conversion from a json file

richgalloway — Fri, 24 Jun 2022 00:49:14 GMT

The dot operator is overloaded so it often causes confusing results. Try renaming fields with dots into something else as soon as possible.

| rename *.*.* as *_*_* | eval output = mvappend(customfield_26202_child_value, customfield_26204_child_value) | mvexpand output | table output

Re: Issue with point separator, after conversion from a json file

timo258 — Fri, 24 Jun 2022 11:08:41 GMT

Thank you very much! It works! 👏

I have a lot of fields like that, is it possible to extract the fields already with "_" instad of "." while forwarding?

Re: Issue with point separator, after conversion from a json file

richgalloway — Fri, 24 Jun 2022 12:40:47 GMT

The rename command in my answer will change the dots in all field names to underscores.

The spath and xpath commands will use dots to separate field name parts. There is no setting/option to change that.

Universal Forwarders cannot change data. Heavy forwarders may be able to, depending on when and how the fields are extracted. If the extraction is at search-time then the HF cannot do it.