Hi,
I need to convert the following into a single query that uses the EVAL command in order to perform extractions.
I currently have the following:
index="identitynow" |spath path=action |rename action as authentication_method, index="identitynow" |spath path=name |rename name as authentication_service,index="identitynow" |spath path=message |
rename message as reason,index="identitynow" |spath path=status |rename status as action,index="identitynow" |spath path=source |rename source as src,index="identitynow" |spath path=source_host |
rename source_host as src_user_id,index="identitynow" |spath path=apiUsername |rename apiUsername as user
Is it possible to use the spath function with the EVAL command?
Thank you so much for all your help!
I solved the problem, thanks😀:
.....
| eval authentication_method =spath(_raw,"action")
| eval authentication_service = spath(_raw,"name")
| eval reason =spath(_raw,"message")
| eval action=spath(_raw,"status")
| eval src=spath(_raw,"source")
| eval src_user_id = spath(_raw,"source_host")
| eval user=spath(_raw,"apiUsername")
Basically, I have an index and some of the fields are in JSON format. I need to extract them and make individual fields for them.
Spath was the only way I could access the values in JSON format and turn them into fields. I am unable to add the Spath into the props.conf - only extraction, field alias and eval.
Can you please help?
Does anyone know the answer to this issue please as I need it for CIM compliance?
Does anyone know the answer to this please?
You have labelled this question as summary indexing. Perhaps if you could explain what it is that you are trying to achieve, we might be able to find a way to do it.
Basically, I have an index and some of the fields are in JSON format. I need to extract them and make individual fields for them.
Spath was the only way I could access the values in JSON format and turn them into fields. I am unable to add the Spath into the props.conf - only extraction, field alias and eval.
Can you please help?