Splunk Search

Issue with point separator, after conversion from a json file

timo258
Explorer

Hi together!

I have an issue with the point separator, after conversion from a json file.

This is raw json:

"customfield_26202" : { "self" : "link", "value" : "Software: Softwareentwicklung und Product Security", "id" : "30705", "disabled" : false, "child" : { "self" : "link", "value" : "Software-Projektleiter", "id" : "30771", "disabled" : false

Splunk extracts the field: customfield_26202.child.value="Software-Projektleiter" (Done with _json sourcetype)

Now I want to merge to fields like this:

| eval output = mvappend(customfield_26202.child.value, customfield_26204.child.value)
| mvexpand output
| table output

When I do exactly the same thing without .child.value everything works fine.

I tried it with several quotation marks (", ' etc.) nothing helps.

Any idea what I do wrong? Thank you!

Timo

Labels (2)
Tags (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The dot operator is overloaded so it often causes confusing results.  Try renaming fields with dots into something else as soon as possible.

| rename *.*.* as *_*_*
| eval output = mvappend(customfield_26202_child_value, customfield_26204_child_value)
| mvexpand output
| table output
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The dot operator is overloaded so it often causes confusing results.  Try renaming fields with dots into something else as soon as possible.

| rename *.*.* as *_*_*
| eval output = mvappend(customfield_26202_child_value, customfield_26204_child_value)
| mvexpand output
| table output
---
If this reply helps you, Karma would be appreciated.

timo258
Explorer

Thank you very much! It works! 👏

I have a lot of fields like that, is it possible to extract the fields already with "_" instad of "." while forwarding?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The rename command in my answer will change the dots in all field names to underscores.

The spath and xpath commands will use dots to separate field name parts.  There is no setting/option to change that.

Universal Forwarders cannot change data.  Heavy forwarders may be able to, depending on when and how the fields are extracted.  If the extraction is at search-time then the HF cannot do it.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...