Hi all, I have a table like this _time file1.txt file2.txt file3.txt *.txt 1472160022 1472160022 1472160000 1472160099 ... 1472160024 1472160100 1472160300 1472160040 ... ... ... ... ... ... The filename columns are all of the format *.txt but there are so many and they can change in the future that I don't want to hardcode them. I would like to subtract the *.txt from the the _time column I basically want to do     eval *.txt = _time-*.txt    Which would theoretically give these values: _time file1.txt file2.txt file3.txt *.txt 1472160022 0 22 -77 ... 1472160024 -76 -276 -16 ... ... ... ... ... ... But I can't seem to wildcard in the subtraction in the eval. Any ideas are much appreciated!  ... View more

I have a lot of json data that contains periods in the keys. I want to be able to expand one of the arrays in the data with the spath command.  It does not seem to work with a period in the json data in the simple example below: | makeresults | eval _raw=" { \"content\":{ \"jvm.memory\": [{\"num\":1.0},{\"num\":2.0}] } }" | spath | spath path=content.jvm.memory{} output=event_data | mvexpand event_data | eval _raw=event_data | kv The following query does work with an underscore in the key name. | makeresults | eval _raw=" { \"content\":{ \"jvm_memory\": [{\"num\":1.0},{\"num\":2.0}] } }" | spath | spath path=content.jvm_memory{} output=event_data | mvexpand event_data | eval _raw=event_data | kv Are there any ways to work around the periods in the keys? Maybe some sort of mass replace of the periods in the key names only (not the values) or some sort of way to escape the periods in the spath command? ... View more