Splunk Search

spath vs rename

GailLeshinsky
New Member

This is the data:

message: { [-]
operation: create_session
....

I am trying to list the name of the operation. I tried spath and rename: spath is not working, does not return the value 'create_session', but rename does. Why?

spath input=message path=operation output=oper_name
rename message.operation AS oper

Tags (2)
0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="{ 
\"build_version\": \"1.0.20190207114538\",
\"level\": \"INFO\",
\"message\": { 
\"build_version\": \"1.0.20190207114538\",
\"correlation_id\": \"b96a6133-baae-4d2e-8ff5-1e758c485ecd\",
\"operation\": \"create_session\",
\"order_id\": \"53ac061f-6b09-712e-9df0-006ec64a9a4b\",
\"request\": {
},
\"response\": {
},
\"session_id\": \"1bad8fa7-409d-74ef-9a75-4108393f9528\"
},
\"order_id\": \"53ac061f-6b09-712e-9df0-006ec64a9a4b\",
\"session_id\": \"1bad8fa7-409d-74ef-9a75-4108393f9528\",
\"thread\": \"dw-1551 - POST /payments/merchant/N100829/v1/sessions\",
\"timestamp\": \"2019-02-13T03:30:35.426Z\",
\"uid\": \"b96a6133-baae-4d2e-8ff5-1e758c485ecd\"
}"
| spath
| rename message.* as *
| fields - _*

In conclusion, the argument of spath is wrong.
| spath path=message.operation output=oper

0 Karma

GailLeshinsky
New Member

I did try but unsuccessfully. What i shared is pretty much it and I am trying to do the simplest :).

Below is another example. I am not expanding the request and response data because it's not needed.

{ [-]
build_version: 1.0.20190207114538
level: INFO

message: { [-]
build_version: 1.0.20190207114538
correlation_id: b96a6133-baae-4d2e-8ff5-1e758c485ecd

operation: create_session
order_id: 53ac061f-6b09-712e-9df0-006ec64a9a4b

request: { [+]
}

response: { [+]
}

session_id: 1bad8fa7-409d-74ef-9a75-4108393f9528

}

order_id: 53ac061f-6b09-712e-9df0-006ec64a9a4b

session_id: 1bad8fa7-409d-74ef-9a75-4108393f9528

thread: dw-1551 - POST /payments/merchant/N100829/v1/sessions

timestamp: 2019-02-13T03:30:35.426Z

uid: b96a6133-baae-4d2e-8ff5-1e758c485ecd

}

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@GailLeshinsky,
Do you have some sample event to share?
Have you tried - spath input=message path=message.operation output=oper_name ?

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...