Hi together!
I have an issue with the point separator, after conversion from a json file.
This is raw json:
"customfield_26202" : { "self" : "link", "value" : "Software: Softwareentwicklung und Product Security", "id" : "30705", "disabled" : false, "child" : { "self" : "link", "value" : "Software-Projektleiter", "id" : "30771", "disabled" : false
Splunk extracts the field: customfield_26202.child.value="Software-Projektleiter" (Done with _json sourcetype)
Now I want to merge to fields like this:
| eval output = mvappend(customfield_26202.child.value, customfield_26204.child.value)
| mvexpand output
| table output
When I do exactly the same thing without .child.value everything works fine.
I tried it with several quotation marks (", ' etc.) nothing helps.
Any idea what I do wrong? Thank you!
Timo
The dot operator is overloaded so it often causes confusing results. Try renaming fields with dots into something else as soon as possible.
| rename *.*.* as *_*_*
| eval output = mvappend(customfield_26202_child_value, customfield_26204_child_value)
| mvexpand output
| table output
The dot operator is overloaded so it often causes confusing results. Try renaming fields with dots into something else as soon as possible.
| rename *.*.* as *_*_*
| eval output = mvappend(customfield_26202_child_value, customfield_26204_child_value)
| mvexpand output
| table output
Thank you very much! It works! 👏
I have a lot of fields like that, is it possible to extract the fields already with "_" instad of "." while forwarding?
The rename command in my answer will change the dots in all field names to underscores.
The spath and xpath commands will use dots to separate field name parts. There is no setting/option to change that.
Universal Forwarders cannot change data. Heavy forwarders may be able to, depending on when and how the fields are extracted. If the extraction is at search-time then the HF cannot do it.