@flle that's the way spath works, the result of spath on the non-json field will generate a null output, so results will overwritten. Your workaround is the right solution for this and this is often the way you do things with Splunk when dealing with two or more different data types, e.g. the construct | eval myfield=if(data_type=1, type1_field, type2_field)
| eval anotherfield=case(data_type=1, type1_field, data_type=2, type2_field, data_type=3, type3_field, 1==1, "Unknown") where you do conditional evaluations and field assignment based on your criteria.
... View more