I am extracting nested JSON with KV_MODE = JSON, which seems to work correctly.
My problem is, I am getting field names with hyphens in it (like in the raw event) e.g. "alert.expl.cnc-services.cnc-service.sid". First of all, is there any possibility of key cleaning while using KV_MODE = JSON extraction? For example I am not able to use the extracted field above in coalesce function because of the hyphen. Can anybody help me?
You cannot prevent it without doing your own manual field extraction but what you can do is remove/replace them at the beginning of your search by doing something like this (which would best be done inside a macro called dash2underscore)
.... | rename *-*-*-*-*-* AS *_*_*_*_*_*, *-*-*-*-* AS *_*_*_*_*, *-*-*-* AS *_*_*_*, *-*-* AS *_*_*, *-* AS *_*