Splunk Search

Why do fields extracted from JSON by spath in eval result in null?

stricq
Engager

I cannot use any of the fields extracted by spath inside an eval.  The result is always null.

Input: (formatted for easy reading)

 

{
  "meta": {
    "emit_interval_s": 600
  },
  "operations": {
    "kv": {
      "Get": {
        "total_count": 4,
        "percentiles_us": {
          "75": 17747.0,
          "95": 18706.0,
          "98": 18706.0,
          "99": 18706.0,
          "100": 18706.0
        }
      },
      "GetClusterConfig": {
        "total_count": 708,
        "percentiles_us": {
          "75": 13723.0,
          "95": 14339.550000000001,
          "98": 14567.56,
          "99": 18207.0,
          "100": 18207.0
        }
      },
      "GetMeta": {
        "total_count": 4,
        "percentiles_us": {
          "75": 15776.75,
          "95": 16761.0,
          "98": 16761.0,
          "99": 16761.0,
          "100": 16761.0
        }
      }
    }
  }
}

 

And this is query:

| spath input=json_field | eval a=operations.kv.Get.percentiles_us.100 | table json_field operations.kv.Get.percentiles_us.100 a

In the output, a is always null but the operations.kv.Get.percentiles_us.100 always displays the correct value.

What's happening here?

Labels (1)
0 Karma
1 Solution

stricq
Engager

Of course, I've found the answer already.  The trick is to use rename.

| rename operations.kv.Get.total_count as totalCount, operations.kv.Get.percentiles_us.100 as getPercentile100us | eval getPercentile100ms=(getPercentile100us/1000)

 

View solution in original post

stricq
Engager

Of course, I've found the answer already.  The trick is to use rename.

| rename operations.kv.Get.total_count as totalCount, operations.kv.Get.percentiles_us.100 as getPercentile100us | eval getPercentile100ms=(getPercentile100us/1000)

 

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Build the Future of Agentic AI: Join the Splunk Agentic Ops Hackathon

AI is changing how teams investigate incidents, detect threats, automate workflows, and build intelligent ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...