Reporting

How to convert multiple spath commands into a single EVAL command?

POR160893
Builder

Hi,

I need to convert the following into a single query that uses the EVAL command in order to perform extractions.

I currently have the following:
index="identitynow" |spath path=action |rename action as authentication_method, index="identitynow" |spath path=name |rename name as authentication_service,index="identitynow" |spath path=message |
rename message as reason,index="identitynow" |spath path=status |rename status as action,index="identitynow" |spath path=source |rename source as src,index="identitynow" |spath path=source_host |
rename source_host as src_user_id,index="identitynow" |spath path=apiUsername |rename apiUsername as user

Is it possible to use the spath function with the EVAL command?


Thank you so much for all your help!

Labels (1)
0 Karma

POR160893
Builder

I solved the problem, thanks😀:


.....
| eval authentication_method =spath(_raw,"action")
| eval authentication_service = spath(_raw,"name")
| eval reason =spath(_raw,"message")
| eval action=spath(_raw,"status")
| eval src=spath(_raw,"source")
| eval src_user_id = spath(_raw,"source_host")
| eval user=spath(_raw,"apiUsername")



0 Karma

POR160893
Builder

Basically, I have an index and some of the fields are in JSON format. I need to extract them and make individual fields for them.

Spath was the only way I could access the values in JSON format and turn them into fields. I am unable to add the Spath into the props.conf - only extraction, field alias and eval.

Can you please help?

0 Karma

POR160893
Builder

Does anyone know the answer to this issue please as I need it for CIM compliance?

0 Karma

POR160893
Builder

Does anyone know the answer to this please?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You have labelled this question as summary indexing. Perhaps if you could explain what it is that you are trying to achieve, we might be able to find a way to do it.

POR160893
Builder

Basically, I have an index and some of the fields are in JSON format. I need to extract them and make individual fields for them.

Spath was the only way I could access the values in JSON format and turn them into fields. I am unable to add the Spath into the props.conf - only extraction, field alias and eval.

Can you please help?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...