How to iterate over the values of a complex field?

[Evgenii]

The event has a field:

{
...
some_field: {
 key1: value1
 key2: value2
}
...
}

How to iterate over the values of "some_field" field?

For example I need to get max value.

I need something like this:

... | eval filed_max_value=max(map_values(some_field))

For map_value I get error: Error in 'EvalCommand': The 'map_values' function is unsupported or undefined.

Could you also explain how to use map_keys and map_values functions ?

[Evgenii]

Magic with 

spath | foreach some_field.*

 works.

Thanks a lot!

[bowesmana]

Also, those functions you reference are from DSP, not Splunk. 

[bowesmana · Accepted solution]

Here's an example that uses foreach to iterate through the keys/values within somefield.

| makeresults
| eval _raw="{\"some_field\": {
\"key1\": 10,
\"key2\": 20,
\"key3\": 5,
\"key4\": 77,
\"key5\": 33,
}
}"
| spath
| foreach some_field.* [
  | eval max=max('<<FIELD>>', max), max_field_key=if('<<FIELD>>'=max, "<<MATCHSTR>>", max_field_key)
]

Note that if there are duplicate values, it will take the last field name as the max_field_key.

Anyway, hope this helps.