I want to move the spath from search query to the auto extraction configuration ie in props.conf and transforms.conf. Is this possible?
index=myindex | rex max_match=0 "(?
spath breaks KV from complex JSON too. Hence I want use spath, but in configuration files instead of search query.
Given the fact that spath is happening after mvexpand and a rex -- I'm not sure it helps.
However if you were trying to basically have a single automatically extracted path command:
search foo=* | spath input=foo output=bar path=a.b
That is equivalent to (Spath Eval Function😞
search foo=* | eval bar=spath(foo, "a.b")
And you can embed that eval as a calculated field (Define Calculated Fields) to make it automatically extracted.
I embedded in props.conf and not getting the results.
EVAL-bar = spath(foo, "a.b")
What am I doing wrong?
Did you set the stanza correctly? eg:
Also the parse won't show up in an Events search, need to table or similar.