topic Re: Splunk Query when attribute having dot seperator in Splunk Search

Splunk Query when attribute having dot seperator

rahulmittal2391 — Thu, 23 May 2024 14:42:05 GMT

not able to search with any attribute which are having .(dot) like env.cookieSize

NOT WORKING

------------------

WORKING

index="ss-prd-dkp" "*price?sailingId=IC20240810&currencyIso=USD&categoryId=pt_internet" | spath status | search status=500 | spath "context.duration" | search "context.duration"="428.70000000006985"

Let me know the solution for this

context: { [-] duration: 428.70000000006985 env.automation-bot: false env.cookiesSize: 7670 env.laneColor: blue }

Re: Splunk Query when attribute having dot seperator

ITWhisperer — Thu, 23 May 2024 17:05:24 GMT

Try using the json_extract_exact function (which doesn't use paths and therefore avoids the issue of keys looking like paths.

| spath context | eval cookiesSize=json_extract_exact(context, "env.cookiesSize")

Re: Splunk Query when attribute having dot seperator

rahulmittal2391 — Fri, 24 May 2024 13:03:36 GMT

how we can filter it with providing the value 7670

Re: Splunk Query when attribute having dot seperator

yuanliu — Fri, 24 May 2024 17:59:42 GMT

Use single quote to protect field names when there is some undesirable side effects from flattened JSON path. (search command cannot finesse this, unfortunately.)

index="ss-prd-dkp" "*price?sailingId=IC20240810&currencyIso=USD&categoryId=pt_internet" | where status=500 AND 'context.duration' == 428.70000000006985 AND 'context.env.cookiesSize' == 7670

But note:

Please use raw text format when sharing structured data.
Those spath commands are not necessary.