Thanks for your help, I really appreciate the time you put it. I asked in good faith I can learn this. streaming languages — like JQ I mentioned — are harder, yes, functional languages are harder, y...
See more...
Thanks for your help, I really appreciate the time you put it. I asked in good faith I can learn this. streaming languages — like JQ I mentioned — are harder, yes, functional languages are harder, yes, but all is doable. Yes, shown json is tricker, but I just happen to know, that there will be just one query there, and if not, I can call one more reduce in JQ and I'm good, still oneliner. Regarding the SPL — the spl solution is just crazy. I just cannot see what each individual part does and why. And the documentation does it make it harder instead of easier. But I probably miss some basic premise of splunk. Ok, simple sample, simpler task. | makeresults
| eval _raw="{
\"json\": {
\"class\": \"net.ttddyy.dsproxy.support.SLF4JLogUtils\",
},
}" Use regex to remove word ttddyy and return .json.class. Should be exceptionally trivial. If I ran that just thing above I see the json. OK, now projection: … | table _raw.json.class no. … | table json.class no. ... | table _raw yes. OK, so maybe it's not parsed or whatever. spath to the rescue. … | spath _raw.json.path | table json.path //please consider this as all potential combinations of cartesian products of all subpaths from _raw.json.path and same with table. no! Ok(!!) maybe it's input parameter: ... | spath input=_raw.json path=json.class | table json.class //all cartesian products again. no. ok. .. So maybe we need output for something I don't know what: | spath input=_raw path=json.class output=aaaaa | table aaaaa //all cartesian products of subpaths again. 30 minutes passed... It's just-a-simple-projection. No luck and I didn't even get to regex, which will be true struggle (all regex flavors are really easy, that's not the crux of the problem). chatgpt thinks this is the solution: | makeresults
| eval _raw="{\"json\": {\"class\": \"net.ttddyy.dsproxy.support.SLF4JLogUtils\"}}"
| spath input=_raw path=json.class
| table json.class but it isn't. Does not print anything(it's so confusing, that trained chatgpt cannot do projection OR it does not work on our heavily paid sw). Can you please explain, how simple projection works in splunk and what steps the engine really do internally since it's really mystery? In jq to compare: jq -n '{ "json": { "class": "net.ttddyy.dsproxy.support.SLF4JLogUtils", } } | .json | .class | sub("ttddyy";"goddamm-easy")' to explain: 1) declare json 2) take .json subtree 3) take .class subtree 4) do replacement. 40s, straightforward. UPDATE: if I export data returned for table, and then download the data, I got different results in file than on screen, so I guess that what-is-shown on screen is different to what-the-data-of-query-is, which is probably source of confusion, since I'm working with something I can see, while splunk probably work with some datastructure I'm not aware of. {
"preview": false,
"result": {
"json.msg": //:|
...