Hi everyone,
currently, i am trying to expand one of the multiple field values but i am getting the result with the below error.
Field 'deployment' does not exist in the data.
index=json
|rex mode=sed "s/.*-\s//g"
|spath
|rename ops{}.steps{}.steps{}.address{}.deployment as deployment
|mvexpand deployment
|mvexpand operation
|table deployment
Put the field name in double quotes (usually it is single quotes for field names but rename seems to operate differently)
|rename "ops{}.steps{}.steps{}.address{}.deployment" as deployment
anyone ?
If you don't have the deployment field, what fields do you have?
Hi, I have shared the logs with you in DM
Can you please share some sample events?
Meanwhile, you can try this rename as well.
| rename "ops.steps.steps.address.deployment" as deployment
KV
Thanks much @kamlesh_vaghela
I have shared the logs in DM, please check