Issue with point separator, after conversion from a json file

[timo258]

Hi together!

I have an issue with the point separator, after conversion from a json file.

This is raw json:

"customfield_26202" : { "self" : "link", "value" : "Software: Softwareentwicklung und Product Security", "id" : "30705", "disabled" : false, "child" : { "self" : "link", "value" : "Software-Projektleiter", "id" : "30771", "disabled" : false

Splunk extracts the field: customfield_26202.child.value="Software-Projektleiter" (Done with _json sourcetype)

Now I want to merge to fields like this:

| eval output = mvappend(customfield_26202.child.value, customfield_26204.child.value)
| mvexpand output
| table output

When I do exactly the same thing without .child.value everything works fine.

I tried it with several quotation marks (", ' etc.) nothing helps.

Any idea what I do wrong? Thank you!

Timo

[richgalloway · Accepted solution]

The dot operator is overloaded so it often causes confusing results.  Try renaming fields with dots into something else as soon as possible.

| rename *.*.* as *_*_*
| eval output = mvappend(customfield_26202_child_value, customfield_26204_child_value)
| mvexpand output
| table output

[timo258]

Thank you very much! It works! 👏

I have a lot of fields like that, is it possible to extract the fields already with "_" instad of "." while forwarding?

[richgalloway]

The rename command in my answer will change the dots in all field names to underscores.

The spath and xpath commands will use dots to separate field name parts.  There is no setting/option to change that.

Universal Forwarders cannot change data.  Heavy forwarders may be able to, depending on when and how the fields are extracted.  If the extraction is at search-time then the HF cannot do it.