Hi,
I was able to do a search using this SPL
index="myapp_index" source="d:\\splunk\\test.json" | spath input=payload | fields _id ident source | head 10
for the following data, but the problem I have is the "source" is giving me "d:\\splunk\\test.json" instead of the source with the IP address...
What do I need to do to extract the source and/or ignore the "source" for the filename?
Looking at your payload value field of the initial JSON object, it's not actually showing a complete valid JSON object, but that may just be your screen capture.
You can always rename the original source before the spath statement.
However, the source in the JSON is an array, so your field would be source{}, e.g. see this
| makeresults
| eval _raw="{\"id\":\"1\",\"payload\":\"{\\\"pod\\\":\\\"123\\\",\\\"source\\\":[\\\"192.168.24.1\\\":40962]}\"}"
| eval source="file"
| spath
| spath input=payload
so you would just need to do
| rename source{} as source
Looking at your payload value field of the initial JSON object, it's not actually showing a complete valid JSON object, but that may just be your screen capture.
You can always rename the original source before the spath statement.
However, the source in the JSON is an array, so your field would be source{}, e.g. see this
| makeresults
| eval _raw="{\"id\":\"1\",\"payload\":\"{\\\"pod\\\":\\\"123\\\",\\\"source\\\":[\\\"192.168.24.1\\\":40962]}\"}"
| eval source="file"
| spath
| spath input=payload
so you would just need to do
| rename source{} as source
Hi,
Thanks for your help with the renaming of source field ... source{} did the trick!
However, I was reading up List - Splunk Documentation
and still trying to retrieve the source IP address and source port from this field via source{}[0] and source{}[1], but I'm still struggling with trying to get this.
Can you pls share how this can be done correctly? Thank you!
"source": ["222.186.42.164", 4780],
| rename source{} as source
| eval ip=mvindex(source,0), port=mvindex(source,1)
Thank you! That did it!