Getting Data In

How do you use extracted JSON fields in transactions and buckets?

nfieglein
Path Finder

I tried doing the following and got back nothing:
sourcetype=json | transaction 'LogEntry.Content.SvctagSegmentGrp.DpsNum'

but had no results. However, when I do the following, I get the expected results:
sourcetype=json | eval DispatchNumber='LogEntry.Content.SvctagSegmentGrp.DpsNum' | transaction DispatchNumber

Has anyone encountered this issue?

0 Karma
1 Solution

aweitzman
Motivator

Remove the single-quotes from your field name:

sourcetype=json | transaction LogEntry.Content.SvctagSegmentGrp.DpsNum

View solution in original post

aweitzman
Motivator

Remove the single-quotes from your field name:

sourcetype=json | transaction LogEntry.Content.SvctagSegmentGrp.DpsNum

nfieglein
Path Finder

OK, that worked for transaction, but when I do something like strptime, I need the single quotes. Is there some scorecard indicating when and when not?
eval TimeOpen = now() - strptime(LogEntry.Content.StatusSegmentGrp.StatusDate, "%a %b %d %H:%M:%S %Z %Y") - Does not Work
eval TimeOpen = now() - strptime('LogEntry.Content.StatusSegmentGrp.StatusDate', "%a %b %d %H:%M:%S %Z %Y") - Works

transaction LogEntry.Content.StatusSegmentGrp.StatusDate - Works
transaction 'LogEntry.Content.StatusSegmentGrp.StatusDate' - Does not Work

0 Karma

aweitzman
Motivator

Based on your two scenarios, it would appear that you need them when you're passing the field name to an eval function (like strptime), but not in the case where it's just an argument to a command (like transaction).

0 Karma

nfieglein
Path Finder

I would have thought so as well, however, when passing a field to a macro it only works with no single quotes. I think that there really needs to be a scorecard or some uniformity.

0 Karma

twhitehead
New Member

...many years later... I thought I would just add, I've seen similar symptoms, renaming your field before using it in eval and I believe a few other commands will keep it consistent for you.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...