how to read nested dictionary where the keys are dotted-strings
I have the following posted dictionary
process_dict = {
task.com.company.job1 {
duration = value1
}
task.com.company.job2
{
duration = value2
}
task3.com.company.job1 =
{
duration = value3
}
}
I did the following
| spath path=result.process_dict output=process_data
| eval d_json = json(process_data), d_keys = json_keys(d_json), d_mv = json_array_to_mv(d_keys)
...
| eval duration_type = ".duration"
...
| eval duration = json_extract(process_data, d_mv.'duration_type')
I am not able to capture the value from "duration" key.
HOWEVER, if the key was just a single word (without '.'), this would work.
ie. task_com instead of task.com.company.job2
TIA
json_extract is documented as not handling periods in the names and suggests using json_extract_exact, but it does not appear to work with an array of keys
| makeresults
| fields - _time
| eval splunk_path="{\"system.splunk.path\":\"/opt/splunk/\",\"system.splunk.path2\":\"/opt/splunk/\"}"
| eval paths=mvappend("system.splunk.path","system.splunk.path2")
| eval extracted_path=json_extract_exact(splunk_path, "system.splunk.path")
| eval extracted_path2=json_extract_exact(splunk_path, "system.splunk.path2")
| eval extracted_paths=json_extract_exact(splunk_path, paths)