Hi Guys,
I have a stream of JSONs and I want to search for the JSONs which name
field is John
. It's just like writing WHERE name="John"
in SQL.
I tried to use spath command without success. I wrote:
source="tcp:8601" sourcetype="_json" | spath path=name output="John"
What would you advise me to do?
The spath
command creates the fields. If you already have KV_MODE=JSON
set for this sourcetype, this command should not be necessary. In any case, it does not filter so you have to use search
or where
for that after the fields are created, maybe like this:
source="tcp:8601" sourcetype="_json" | spath | search name="John"
Or maybe just:
source="tcp:8601" sourcetype="_json"| search name="John"