Getting Data In

moving "spath" from query to config file

Path Finder

Hi All
I want to move the spath from search query to the auto extraction configuration ie in props.conf and transforms.conf. Is this possible?

index=myindex | rex maxmatch=0 "(?<jsonfield>{[^}]+})" | mvexpand jsonfield |spath input=jsonfield

spath breaks KV from complex JSON too. Hence I want use spath, but in configuration files instead of search query.

Splunk Employee
Splunk Employee

Given the fact that spath is happening after mvexpand and a rex -- I'm not sure it helps.

However if you were trying to basically have a single automatically extracted path command:

search foo=* | spath input=foo output=bar path=a.b

That is equivalent to (Spath Eval Function😞

search foo=* | eval bar=spath(foo, "a.b")

And you can embed that eval as a calculated field (Define Calculated Fields) to make it automatically extracted.

I embedded in props.conf and not getting the results.
EVAL-bar = spath(foo, "a.b")
What am I doing wrong?

0 Karma

Path Finder

Did you set the stanza correctly? eg: [source::your_source]

Also the parse won't show up in an Events search, need to table or similar.

0 Karma