Splunk Search

Spath field extract with period

mpaw
Explorer

Hi All,

I am trying to extract fields using spath command. I noticed that fields with period in it cannot be extracted; as for the other fields without period are being extracted correctly.

(EXAMPLE FIELDS: action.email AND alert.suppress.period)

Is there any workaround for this? Any help would be much appreciated. Thanks!

 

Here is my script:

| rest /servicesNS/nobody/SA-ITOA/event_management_interface/correlation_search
| eval value=spath(value,"{}")
| mvexpand value
| eval name = spath(value, "name")
| eval search = spath(value, "search")
| eval schedule = spath(value, "cron_schedule")
| eval status = spath(value, "disabled")
| eval send_email = spath(value, "action.email")
| eval suppress_period = spath(value, "alert.suppress.period")
| fields name, search, schedule, status, send_email, suppress_period

Labels (1)
0 Karma
1 Solution

to4kawa
Ultra Champion

| spath input=value
and rename

View solution in original post

to4kawa
Ultra Champion

| eval send_email = spath(value, 'action.email')
| eval suppress_period = spath(value, 'alert.suppress.period')

try '(single quote)

mpaw
Explorer

I tried the single quote but still no luck. 😢

0 Karma

to4kawa
Ultra Champion

| spath input=value
and rename

mpaw
Explorer

It works! Thanks so much! 

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...