Getting Data In

How to remove {} in Json extracted fields during search time without using rename in the search?


Hello All,
I have JSON data and sometimes it is nested and sometimes it is not, whenever it is a nested array I have a {} in the field name, and when it's not there is no {}. I'm trying to make a field alias to a common field name. But, I want to write a single alias to convert the field name if {} is present or not to a new name?
Any leads on how can I do it? (Either remove {} before the fields are extracted at search time or aliasing in the props.conf to a new name.)

eg: items{}.description once, items.description the other other time --> rename to items.description during the search time without using rename command
remove {} before fields are extracted on the search head.

P.S: I don't want to do index time field extraction.

#fieldaliasing #json 


Labels (3)
Tags (2)
0 Karma


You can create calculated fields   to create a new field. You can also do the same eval inline in the search.

Inline search:

| eval "item_description"=coalesce('item.description','item{}.description')

Props.conf (on search head):
EVAL-item_description = coalesce('item.description','item{}.description')
0 Karma

Splunk Employee
Splunk Employee

Hey @manikanta461,

Try using spath in the search query and in the output parameter, you can set the fieldname that you want.

Related docs for spath command can be found here -


If you find the answer helpful, an upvote/karma is appreciated
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...