Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- How to convert multiple spath commands into a sing...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to convert multiple spath commands into a single EVAL command?
Hi,
I need to convert the following into a single query that uses the EVAL command in order to perform extractions.
I currently have the following:
index="identitynow" |spath path=action |rename action as authentication_method, index="identitynow" |spath path=name |rename name as authentication_service,index="identitynow" |spath path=message |
rename message as reason,index="identitynow" |spath path=status |rename status as action,index="identitynow" |spath path=source |rename source as src,index="identitynow" |spath path=source_host |
rename source_host as src_user_id,index="identitynow" |spath path=apiUsername |rename apiUsername as user
Is it possible to use the spath function with the EVAL command?
Thank you so much for all your help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I solved the problem, thanks😀:
.....
| eval authentication_method =spath(_raw,"action")
| eval authentication_service = spath(_raw,"name")
| eval reason =spath(_raw,"message")
| eval action=spath(_raw,"status")
| eval src=spath(_raw,"source")
| eval src_user_id = spath(_raw,"source_host")
| eval user=spath(_raw,"apiUsername")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Basically, I have an index and some of the fields are in JSON format. I need to extract them and make individual fields for them.
Spath was the only way I could access the values in JSON format and turn them into fields. I am unable to add the Spath into the props.conf - only extraction, field alias and eval.
Can you please help?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does anyone know the answer to this issue please as I need it for CIM compliance?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does anyone know the answer to this please?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You have labelled this question as summary indexing. Perhaps if you could explain what it is that you are trying to achieve, we might be able to find a way to do it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Basically, I have an index and some of the fields are in JSON format. I need to extract them and make individual fields for them.
Spath was the only way I could access the values in JSON format and turn them into fields. I am unable to add the Spath into the props.conf - only extraction, field alias and eval.
Can you please help?
Splunk Mobile: Your Brand-New Home Screen
Introducing Value Insights (Beta): Understand the Business Impact your organization ...
Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...
