Hi guys,
I'm trying to do something that I expected to be very simple, so I guess I'm missing something big.
This is my test SPL:
| makeresults
| eval data=json_object("id", "123")| spath input=data| table data.id
I want to be able to refer to the data.id field, but I can't. how do I convert "data" into a parsed json?
TIA
Asaf
Hi @asafd
Try this:
| makeresults
| eval data=json_object("id","123")| spath input=data
|multikv
|table id
Hi @asafd
Try this:
| makeresults
| eval data=json_object("id","123")| spath input=data
|multikv
|table id