Reporting

How to convert multiple spath commands into a single EVAL command?

POR160893
Builder

Hi,

I need to convert the following into a single query that uses the EVAL command in order to perform extractions.

I currently have the following:
index="identitynow" |spath path=action |rename action as authentication_method, index="identitynow" |spath path=name |rename name as authentication_service,index="identitynow" |spath path=message |
rename message as reason,index="identitynow" |spath path=status |rename status as action,index="identitynow" |spath path=source |rename source as src,index="identitynow" |spath path=source_host |
rename source_host as src_user_id,index="identitynow" |spath path=apiUsername |rename apiUsername as user

Is it possible to use the spath function with the EVAL command?


Thank you so much for all your help!

Labels (1)
0 Karma

POR160893
Builder

I solved the problem, thanks😀:


.....
| eval authentication_method =spath(_raw,"action")
| eval authentication_service = spath(_raw,"name")
| eval reason =spath(_raw,"message")
| eval action=spath(_raw,"status")
| eval src=spath(_raw,"source")
| eval src_user_id = spath(_raw,"source_host")
| eval user=spath(_raw,"apiUsername")



0 Karma

POR160893
Builder

Basically, I have an index and some of the fields are in JSON format. I need to extract them and make individual fields for them.

Spath was the only way I could access the values in JSON format and turn them into fields. I am unable to add the Spath into the props.conf - only extraction, field alias and eval.

Can you please help?

0 Karma

POR160893
Builder

Does anyone know the answer to this issue please as I need it for CIM compliance?

0 Karma

POR160893
Builder

Does anyone know the answer to this please?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You have labelled this question as summary indexing. Perhaps if you could explain what it is that you are trying to achieve, we might be able to find a way to do it.

POR160893
Builder

Basically, I have an index and some of the fields are in JSON format. I need to extract them and make individual fields for them.

Spath was the only way I could access the values in JSON format and turn them into fields. I am unable to add the Spath into the props.conf - only extraction, field alias and eval.

Can you please help?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...