How to convert multiple spath commands into a single EVAL command?

[POR160893]

Hi,

I need to convert the following into a single query that uses the EVAL command in order to perform extractions.

I currently have the following:
index="identitynow" |spath path=action |rename action as authentication_method, index="identitynow" |spath path=name |rename name as authentication_service,index="identitynow" |spath path=message |
rename message as reason,index="identitynow" |spath path=status |rename status as action,index="identitynow" |spath path=source |rename source as src,index="identitynow" |spath path=source_host |
rename source_host as src_user_id,index="identitynow" |spath path=apiUsername |rename apiUsername as user

Is it possible to use the spath function with the EVAL command?


Thank you so much for all your help!

[POR160893]

I solved the problem, thanks😀:


.....
| eval authentication_method =spath(_raw,"action")
| eval authentication_service = spath(_raw,"name")
| eval reason =spath(_raw,"message")
| eval action=spath(_raw,"status")
| eval src=spath(_raw,"source")
| eval src_user_id = spath(_raw,"source_host")
| eval user=spath(_raw,"apiUsername")

[POR160893]

Basically, I have an index and some of the fields are in JSON format. I need to extract them and make individual fields for them.

Spath was the only way I could access the values in JSON format and turn them into fields. I am unable to add the Spath into the props.conf - only extraction, field alias and eval.

Can you please help?

[POR160893]

Does anyone know the answer to this issue please as I need it for CIM compliance?

[POR160893]

Does anyone know the answer to this please?

[ITWhisperer]

You have labelled this question as summary indexing. Perhaps if you could explain what it is that you are trying to achieve, we might be able to find a way to do it.

[POR160893]

Basically, I have an index and some of the fields are in JSON format. I need to extract them and make individual fields for them.

Spath was the only way I could access the values in JSON format and turn them into fields. I am unable to add the Spath into the props.conf - only extraction, field alias and eval.

Can you please help?