Getting Data In

where is not working with JSON extracted with spath

ivykp
New Member

Hello there,

I have the next JSON:

{
  "idDeclaracion": "abc123",
  "prospecto": {
    "id": "1111",
    "edad": 24,
    "nombre": "jaime",
    "ubicacion": {
      "direccion": "CL 61",
      "barrio": "Los colores"
    }
  },
  "decisiones": [
    "aprobar",
    "declinar",
    "extraprimar"
  ],
  "exitoso": true
}

I want to filter those events where prospecto.id="1111" and i have tried two ways:

  1. index=idx_eml_err | spath input=message | search prospecto.id="1111"
  2. index=idx_eml_err | spath input=message | where prospecto.id="1111"

Option 1 works well, but option 2 does not. Can somebody please explain me this behavior?

To have in mind, the next query works well: index=idx_eml_err | spath input=message | where idDeclaracion="abc123". The difference between the last query and 2, is that 2 is using the where with a nested field.

Thanks!

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@ivykp,

This should work for you

index=idx_eml_err | spath input=message |where 'prospecto.id'="1111"

where command returns only the results for which the eval expression returns true. These eval-expressions must be Boolean expressions, where the expression returns either true or false. In the json filed, by adding a ' around the field makes it as literal field name

Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@ivykp,

This should work for you

index=idx_eml_err | spath input=message |where 'prospecto.id'="1111"

where command returns only the results for which the eval expression returns true. These eval-expressions must be Boolean expressions, where the expression returns either true or false. In the json filed, by adding a ' around the field makes it as literal field name

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...