How to preventy hyphens in fieldnames with KV_MODE JSON?

[jbrocks]

Hi everybody,

I am extracting nested JSON with KV_MODE = JSON, which seems to work correctly.
My problem is, I am getting field names with hyphens in it (like in the raw event) e.g. "alert.expl.cnc-services.cnc-service.sid". First of all, is there any possibility of key cleaning while using KV_MODE = JSON extraction? For example I am not able to use the extracted field above in coalesce function because of the hyphen. Can anybody help me?

[woodcock]

You cannot prevent it without doing your own manual field extraction but what you can do is remove/replace them at the beginning of your search by doing something like this (which would best be done inside a macro called dash2underscore)

.... | rename *-*-*-*-*-* AS *_*_*_*_*_*, *-*-*-*-* AS *_*_*_*_*, *-*-*-* AS *_*_*_*, *-*-* AS *_*_*, *-* AS *_*

[codebuilder]

You can use a combination of props.conf and transforms.conf to replace the dash "-" with the symbol of your choice.
Within transforms.conf, set DEST_KEY = _raw.

Note that this method requires a HF and would take effect on newly indexed data only (it would not be retroactive).