Getting Data In

moving "spath" from query to config file

splunk_worker
Path Finder

Hi All
I want to move the spath from search query to the auto extraction configuration ie in props.conf and transforms.conf. Is this possible?

index=myindex | rex max_match=0 "(?{[^}]+})" | mvexpand json_field |spath input=json_field

spath breaks KV from complex JSON too. Hence I want use spath, but in configuration files instead of search query.

cpride_splunk
Splunk Employee
Splunk Employee

Given the fact that spath is happening after mvexpand and a rex -- I'm not sure it helps.

However if you were trying to basically have a single automatically extracted path command:

search foo=* | spath input=foo output=bar path=a.b

That is equivalent to (Spath Eval Function😞

search foo=* | eval bar=spath(foo, "a.b")

And you can embed that eval as a calculated field (Define Calculated Fields) to make it automatically extracted.

GauravSplunxter
Explorer

I embedded in props.conf and not getting the results.
EVAL-bar = spath(foo, "a.b")
What am I doing wrong?

0 Karma

camillak
Path Finder

Did you set the stanza correctly? eg: [source::your_source]

Also the parse won't show up in an Events search, need to table or similar.

0 Karma
Get Updates on the Splunk Community!

Bridging the Gap: Splunk Helps Students Move from Classroom to Career

The Splunk Community is a powerful network of users, educators, and organizations working together to tackle ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...