How to retrieve a field named as "source" in a search

[william_choo]

Hi,

I was able to do a search using this SPL

index="myapp_index" source="d:\\splunk\\test.json" | spath input=payload | fields _id ident source | head 10

for the following data, but the problem I have is the "source" is giving me "d:\\splunk\\test.json" instead of the source with the IP address...

What do I need to do to extract the source and/or ignore the "source" for the filename?

[bowesmana · Accepted solution]

Looking at your payload value field of the initial JSON object, it's not actually showing a complete valid JSON object, but that may just be your screen capture.

You can always rename the original source before the spath statement.

However, the source in the JSON is an array, so your field would be source{}, e.g. see this

| makeresults
| eval _raw="{\"id\":\"1\",\"payload\":\"{\\\"pod\\\":\\\"123\\\",\\\"source\\\":[\\\"192.168.24.1\\\":40962]}\"}"
| eval source="file"
| spath
| spath input=payload

  so you would just need to do

| rename source{} as source

[william_choo]

Hi,

Thanks for your help with the renaming of source field ... source{} did the trick!

However, I was reading up List - Splunk Documentation
and still trying to retrieve the source IP address and source port from this field via source{}[0] and source{}[1], but I'm still struggling with trying to get this.

Can you pls share how this can be done correctly? Thank you!

"source": ["222.186.42.164", 4780],

[bowesmana]

| rename source{} as source
| eval ip=mvindex(source,0), port=mvindex(source,1)

[william_choo]

Thank you! That did it!