Getting Data In

where is not working with JSON extracted with spath

ivykp
New Member

Hello there,

I have the next JSON:

{
  "idDeclaracion": "abc123",
  "prospecto": {
    "id": "1111",
    "edad": 24,
    "nombre": "jaime",
    "ubicacion": {
      "direccion": "CL 61",
      "barrio": "Los colores"
    }
  },
  "decisiones": [
    "aprobar",
    "declinar",
    "extraprimar"
  ],
  "exitoso": true
}

I want to filter those events where prospecto.id="1111" and i have tried two ways:

  1. index=idx_eml_err | spath input=message | search prospecto.id="1111"
  2. index=idx_eml_err | spath input=message | where prospecto.id="1111"

Option 1 works well, but option 2 does not. Can somebody please explain me this behavior?

To have in mind, the next query works well: index=idx_eml_err | spath input=message | where idDeclaracion="abc123". The difference between the last query and 2, is that 2 is using the where with a nested field.

Thanks!

0 Karma
1 Solution

renjith_nair
Legend

@ivykp,

This should work for you

index=idx_eml_err | spath input=message |where 'prospecto.id'="1111"

where command returns only the results for which the eval expression returns true. These eval-expressions must be Boolean expressions, where the expression returns either true or false. In the json filed, by adding a ' around the field makes it as literal field name

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@ivykp,

This should work for you

index=idx_eml_err | spath input=message |where 'prospecto.id'="1111"

where command returns only the results for which the eval expression returns true. These eval-expressions must be Boolean expressions, where the expression returns either true or false. In the json filed, by adding a ' around the field makes it as literal field name

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...