Hi Splunkers!
In the current json_extend documentation <https://help.splunk.com/en/splunk-enterprise/spl-search-reference/10.0/evaluation-functions/json-fun...>, if <path> specifies "a scalar or object value," the value should be "[autowrapped] ... within an array;" however, this doesn't appear to be the case:
| makeresults
| eval obj=json_object("foo", "bar") ``` or obj="{\"foo\":\"bar\"}" ```
| eval arr=json_extend(obj, "foo", json_array("baz")) ``` or arr=json_extend(obj, "foo", "[\"baz\"]") ```
If I understand the documentation correctly, "bar" should be coerced to the array ["bar"] and then extended to ["bar","baz"], but it is not. The original object is returned unmodified. json_extend works correctly when the input value is already an array:
| makeresults
| eval obj=json_object("foo", json_array("bar", "baz"))
| eval arr=json_extend(obj, "foo", json_array("qux"))
The example was contrived to illustrate the issue. In practice, the value of foo may be either an array or a scalar. For example, the lookup eval function returns a scaler on a single match and an array on multiple matches. json_extract is similarly inconsistent when it returns a Splunk native type for scalars and a string for arrays:
| makeresults
| eval obj=json_object("foo", "bar")
| eval val=json_extract(obj, "foo") ``` ==> foo ```
| eval obj=json_object("foo", json_array("bar", "baz"))
| eval val=json_extract(obj, "foo") ``` ==> ["bar","baz"] ```
If scalars can be coerced into arrays, values that may be either scalars or arrays can be parsed by json_array_to_mv or other functions without custom wrappers using if, case, replace, etc.
Have you encountered this issue? How have you solved it?
