Splunk Search

Why do fields extracted from JSON by spath in eval result in null?

stricq
Engager

I cannot use any of the fields extracted by spath inside an eval.  The result is always null.

Input: (formatted for easy reading)

 

{
  "meta": {
    "emit_interval_s": 600
  },
  "operations": {
    "kv": {
      "Get": {
        "total_count": 4,
        "percentiles_us": {
          "75": 17747.0,
          "95": 18706.0,
          "98": 18706.0,
          "99": 18706.0,
          "100": 18706.0
        }
      },
      "GetClusterConfig": {
        "total_count": 708,
        "percentiles_us": {
          "75": 13723.0,
          "95": 14339.550000000001,
          "98": 14567.56,
          "99": 18207.0,
          "100": 18207.0
        }
      },
      "GetMeta": {
        "total_count": 4,
        "percentiles_us": {
          "75": 15776.75,
          "95": 16761.0,
          "98": 16761.0,
          "99": 16761.0,
          "100": 16761.0
        }
      }
    }
  }
}

 

And this is query:

| spath input=json_field | eval a=operations.kv.Get.percentiles_us.100 | table json_field operations.kv.Get.percentiles_us.100 a

In the output, a is always null but the operations.kv.Get.percentiles_us.100 always displays the correct value.

What's happening here?

Labels (1)
0 Karma
1 Solution

stricq
Engager

Of course, I've found the answer already.  The trick is to use rename.

| rename operations.kv.Get.total_count as totalCount, operations.kv.Get.percentiles_us.100 as getPercentile100us | eval getPercentile100ms=(getPercentile100us/1000)

 

View solution in original post

stricq
Engager

Of course, I've found the answer already.  The trick is to use rename.

| rename operations.kv.Get.total_count as totalCount, operations.kv.Get.percentiles_us.100 as getPercentile100us | eval getPercentile100ms=(getPercentile100us/1000)

 

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...