Spath for getting date json field

[splkdylb]

Hi all,

I'm trying to use spath to extract JSON data from a field name that represents a date:

{
"field1": {
"2019-01-02": []
}
}

but when I try spath input=message output=result field1.2019-01-02 it's not working. I tried to replace the field name with another text (i.e. replace "2019-02-01" with "targetDate") and setting the replaced result in the spath input parameter but it is still not working.

Thank you for your help.

[anantcd]

Try this SPL:

| makeresults 
| eval message="{\"foo\":{\"2019-01-02\":[{\"zoo\":1},{\"baz\":2}]}}" 
| spath input=message output=result path=foo.2019-01-02{}

[woodcock]

Show us an entire raw event.