Spath key with period in it

[mrstrozy]

Hi All,

I am dealing with a key that has a period in it. I am trying to figure out how to use spath to extract it but I haven't had any luck. Here is an example of what the data would look like:

Event:

apples: {
granny.smith: {
color: "green",
crunchy: "true"
}
}

In this case I would like to extract "granny.smith" as a field but I am unable to.

Any help would be much appreciated.

Thanks!

[hcanivel_splunk]

First of all, I don't think the formatting is correct. Your field of granny.smith should certainly be wrapped by quotes to be read properly (try double quotes). I would recommend using any sort of coding library to help do this for you. But, even if the event data was printed in a proper format, you'd need to extract your fields somehow.

I would recommend either of two solutions, presuming your event data is completely in JSON format:

1. Create a custom sourcetype props stanza and specify for KV mode to JSON:

[sourcetype]
KV_MODE = json

• Preferred format as this search extraction will extract for fields from the JSON data consistently reducing need to append to every search query manually
• Reference: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Exampleconfigurationsusingfieldtransfo...

1. Use spath command within your search

*SPL* | spath

• This command will pull from the _raw field by default, but you can specify any other field
• Reference: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath

Either way, once you have those fields, how you can reference these fields thereafter, you'll need to use single quotes for any sort of calculated field manipulation. In your case, if if the fields were indeed extracted and you wanted to search against it, here's an SPL query sample:

index=main 'granny.apple.color' != "green"

Give that a shot.

[niketn]

@mrstrozy do you need granny.smith as a field? It will have a nested JSON in it. Actual fields would be granny.smith.color with value green as per your data. This should work out of the box. Following is an example based on sample data provided:

| makeresults
| eval _raw="{
    \"apples\": {
        \"granny.smith\": {
                \"color\": \"green\",
                \"crunchy\": \"true\"
            }
        }
    }"
| spath