Why is spath returning duplicate value for fields?

[indeed_2000]

Hi I'm trying to use spath to break doen json log, but it duplicates these two fields "time" and "@timestamp" when I create a table! While raw logs show fields that contain only one timestamp!

Here is my query:

index="myindex" | spath input=_raw | dedup time | table time _time @timestamp _raw

Here is output:

time                                                       _time                                             @timestamp
2023-06-16T12:27:54.907Z        2023-06-18 15:55:30         2023-06-18T12:23:01.109495047Z
2023-06-16T12:27:54.907Z                                                              2023-06-18T12:23:01.109495047Z

here is raw log:

_raw
{"server":"mysrv","tags":["_dateparsefailure"],"results":{"statement_id":0},"uniq":"026","@timestamp":"2023-06-18T12:23:01.109495047Z","@version":"1","success":"true","type":"in","http_poller_metadata":{"input":{"http_poller":{"response":{"status_code":200,"headers":{"date":"Sun, 18 Jun 2023 12:27:54 GMT","x-influxdb-build":"OSS","x-request-id":"8cae1609-0dd3-11ee-8ace-005056b7dda2","request-id":"8cae1609-0dd3-11ee-8ace-005056b7dda2","x-influxdb-version":"1.7.8","transfer-encoding":"chunked","content-type":"application/json"},"elapsed_time_ns":4031,"status_message":"OK"},"request":{"retry_count":0,"name":"cpu","host":{"hostname":"logsrv"},"original":{"url":"https://192.168.1.1:8086/query?pretty=true&db=mydb&q=SELECT%20*%20FROM%20%22msg%22%20WHERE%20time%20...","headers":{"Authorization":"Token mytoken"},"method":"get"}}}}},"time":"2023-06-16T12:27:54.907Z","name":"msg","count":1,"connectionname":"myconnection"}

[ITWhisperer]

The commands and sample you provided do not produce the result you provided, so something else may be going on. Please provide more details and examples demonstrating this issue.