Getting Data In

Why is spath returning duplicate value for fields?

indeed_2000
Motivator

Hi I'm trying to use spath to break doen json log, but it duplicates these two fields "time" and "@timestamp" when I create a table! While raw logs show fields that contain only one timestamp!

 

Here is my query:

index="myindex" | spath input=_raw | dedup time | table time _time @timestamp _raw

 

Here is output:

time                                                       _time                                             @timestamp
2023-06-16T12:27:54.907Z        2023-06-18 15:55:30         2023-06-18T12:23:01.109495047Z
2023-06-16T12:27:54.907Z                                                              2023-06-18T12:23:01.109495047Z

 

here is raw log:

_raw
{"server":"mysrv","tags":["_dateparsefailure"],"results":{"statement_id":0},"uniq":"026","@timestamp":"2023-06-18T12:23:01.109495047Z","@version":"1","success":"true","type":"in","http_poller_metadata":{"input":{"http_poller":{"response":{"status_code":200,"headers":{"date":"Sun, 18 Jun 2023 12:27:54 GMT","x-influxdb-build":"OSS","x-request-id":"8cae1609-0dd3-11ee-8ace-005056b7dda2","request-id":"8cae1609-0dd3-11ee-8ace-005056b7dda2","x-influxdb-version":"1.7.8","transfer-encoding":"chunked","content-type":"application/json"},"elapsed_time_ns":4031,"status_message":"OK"},"request":{"retry_count":0,"name":"cpu","host":{"hostname":"logsrv"},"original":{"url":"https://192.168.1.1:8086/query?pretty=true&db=mydb&q=SELECT%20*%20FROM%20%22msg%22%20WHERE%20time%20...","headers":{"Authorization":"Token mytoken"},"method":"get"}}}}},"time":"2023-06-16T12:27:54.907Z","name":"msg","count":1,"connectionname":"myconnection"}

Labels (2)
Tags (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The commands and sample you provided do not produce the result you provided, so something else may be going on. Please provide more details and examples demonstrating this issue.

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...