Hi All,
I am dealing with a key that has a period in it. I am trying to figure out how to use spath to extract it but I haven't had any luck. Here is an example of what the data would look like:
Event:
apples: {
granny.smith: {
color: "green",
crunchy: "true"
}
}
In this case I would like to extract "granny.smith" as a field but I am unable to.
Any help would be much appreciated.
Thanks!
First of all, I don't think the formatting is correct. Your field of granny.smith
should certainly be wrapped by quotes to be read properly (try double quotes). I would recommend using any sort of coding library to help do this for you. But, even if the event data was printed in a proper format, you'd need to extract your fields somehow.
I would recommend either of two solutions, presuming your event data is completely in JSON format:
[sourcetype]
KV_MODE = json
*SPL* | spath
Either way, once you have those fields, how you can reference these fields thereafter, you'll need to use single quotes for any sort of calculated field manipulation. In your case, if if the fields were indeed extracted and you wanted to search against it, here's an SPL query sample:
index=main 'granny.apple.color' != "green"
Give that a shot.
@mrstrozy do you need granny.smith
as a field? It will have a nested JSON in it. Actual fields would be granny.smith.color
with value green
as per your data. This should work out of the box. Following is an example based on sample data provided:
| makeresults
| eval _raw="{
\"apples\": {
\"granny.smith\": {
\"color\": \"green\",
\"crunchy\": \"true\"
}
}
}"
| spath