Why need curly braces {} at the end of field

[herrypeterlee]

I have a data like:

{"adult": false,  "genre_ids": [16, 10751], "id": 1135710, "original_language": "sv", "original_title": "Vem du, Mamma Mu", "vote_average": 6, "vote_count": 2}

I do search:

index="tmdb_my_index"
|mvexpand genre_ids{}
|rename genre_ids{} as genre_id
|table genre_id, id

Why genre_ids{} need the "{}"

[PickleRick]

To add a bit to @gcusello 's answer...

The {} are part of the field's name here. There's no magic., no additional syntax or something like that.

Splunk can, depending on your needs and configuration work with json data in three separate ways each of which has its pros and cons.

1) Indexed extractions - in this way the fields are extracted from the event when it is ingested into splunk and are stored alongside the raw data as indexed fields. Since this can be combined with other methods, it can produce double field values.

2) Automatic key-value extractions from structured data

3) Explicit spath command

Those two latter options are search-time operations and they produce different results in terms of field naming. Also if you need to filter by field's value after doing spath, you need to firstly do spath on every event which is much less effective than filtering in the search early. On the other hand, automatic KV extraction doesn't work on just part of the message.

Anyway, one of those methods produces field named with {} as in your example when they originally contain lists of objects.

But after parsing by splunk, the {} part is just a part of the field's name.

[gcusello]

Hi @herrypeterlee,

curly braces are properly from json format and contain the properties (fields) of the json array.

here you can find some description:

https://www.spiceworks.com/tech/devops/articles/what-is-json/#:~:text=In%20JSON%2C%20data%20is%20rep....

(https://www.microfocus.com/documentation/silk-performer/195/en/silkperformer-195-webhelp-en/GUID-6AF... 

I hint to rename it at the start of the search to avoid problems in the search.

Ciao.

Giuseppe