Splunk Search

spath vs rename

GailLeshinsky
New Member

This is the data:

message: { [-]
operation: create_session
....

I am trying to list the name of the operation. I tried spath and rename: spath is not working, does not return the value 'create_session', but rename does. Why?

spath input=message path=operation output=oper_name
rename message.operation AS oper

Tags (2)
0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="{ 
\"build_version\": \"1.0.20190207114538\",
\"level\": \"INFO\",
\"message\": { 
\"build_version\": \"1.0.20190207114538\",
\"correlation_id\": \"b96a6133-baae-4d2e-8ff5-1e758c485ecd\",
\"operation\": \"create_session\",
\"order_id\": \"53ac061f-6b09-712e-9df0-006ec64a9a4b\",
\"request\": {
},
\"response\": {
},
\"session_id\": \"1bad8fa7-409d-74ef-9a75-4108393f9528\"
},
\"order_id\": \"53ac061f-6b09-712e-9df0-006ec64a9a4b\",
\"session_id\": \"1bad8fa7-409d-74ef-9a75-4108393f9528\",
\"thread\": \"dw-1551 - POST /payments/merchant/N100829/v1/sessions\",
\"timestamp\": \"2019-02-13T03:30:35.426Z\",
\"uid\": \"b96a6133-baae-4d2e-8ff5-1e758c485ecd\"
}"
| spath
| rename message.* as *
| fields - _*

In conclusion, the argument of spath is wrong.
| spath path=message.operation output=oper

0 Karma

GailLeshinsky
New Member

I did try but unsuccessfully. What i shared is pretty much it and I am trying to do the simplest :).

Below is another example. I am not expanding the request and response data because it's not needed.

{ [-]
build_version: 1.0.20190207114538
level: INFO

message: { [-]
build_version: 1.0.20190207114538
correlation_id: b96a6133-baae-4d2e-8ff5-1e758c485ecd

operation: create_session
order_id: 53ac061f-6b09-712e-9df0-006ec64a9a4b

request: { [+]
}

response: { [+]
}

session_id: 1bad8fa7-409d-74ef-9a75-4108393f9528

}

order_id: 53ac061f-6b09-712e-9df0-006ec64a9a4b

session_id: 1bad8fa7-409d-74ef-9a75-4108393f9528

thread: dw-1551 - POST /payments/merchant/N100829/v1/sessions

timestamp: 2019-02-13T03:30:35.426Z

uid: b96a6133-baae-4d2e-8ff5-1e758c485ecd

}

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@GailLeshinsky,
Do you have some sample event to share?
Have you tried - spath input=message path=message.operation output=oper_name ?

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...