Getting Data In

Dropping blank paths in a JSON search

brutecat
Path Finder

Hi,

I am doing some experimentation wirh regards JSON events. I have two events loaded:

{
"event":
{
"time": "2019-02-10T05:52:03",
"StatsMonitor": {
"time": "2019-02-10T05:52:03",
"name": "StatsMonitor",
"LocalTimetDelta": 0,
"CaptureTimetDelta": 0,
"DeltaTimeAuditLog": 0,
"ActiveUsers": 26
}
}

}

and

{
"action":
{
"StatsMonitor": {
"time": "2019-02-10T05:52:03",
"name": "StatsMonitor",
"LocalTimetDelta": 0,
"CaptureTimetDelta": 0,
"DeltaTimeAuditLog": 0,
"ActiveUsers": 26
}
}
,
"action":
{
"StatsMonitorx": {
"time": "2019-01-10T06:52:03",
"name": "StatsMonitor",
"LocalTimetDelta": 0,
"CaptureTimetDelta": 0,
"DeltaTimeAuditLog": 0,
"ActiveUsers": 52
}
}

}

The index I am using is 'conship'

I have a search:

index=conship | spath
path=event.StatsMonitor
| rename event.time as time, event.StatsMonitor.* as *
| table time ActiveUsers

which is returning both events as results, but has duplicate data coming from the first (which is the correct data).

I would have thought:

spath path=event.StatsMonitor

would have eliminated the data altogether from the second event. Perhaps I could get a blank line, but why am I getting a duplicate from the correct event.

Thanks,

Stan

Tags (3)
0 Karma

poete
Builder

Hello @brutecat,

the bellow does the trick

| makeresults 
| eval _raw="{
          \"event\":
                 {
                 \"time\": \"2019-02-10T05:52:03\",
                  \"StatsMonitor\": {
                          \"time\": \"2019-02-10T05:52:03\",
                          \"name\": \"StatsMonitor\",
                          \"LocalTimetDelta\": 0,
                          \"CaptureTimetDelta\": 0,
                          \"DeltaTimeAuditLog\": 0,
                          \"ActiveUsers\": 26
                     }
                 },
          \"action\":
                 {
                      \"StatsMonitor\": {
                          \"time\": \"2019-02-10T05:52:03\",
                          \"name\": \"StatsMonitor\",
                          \"LocalTimetDelta\": 0,
                          \"CaptureTimetDelta\": 0,
                          \"DeltaTimeAuditLog\": 0,
                          \"ActiveUsers\": 26
                     }
                 }
                 ,
         \"action\":
                 {
                      \"StatsMonitor\": {
                          \"time\": \"2019-01-10T06:52:03\",
                          \"name\": \"StatsMonitor\",
                          \"LocalTimetDelta\": 0,
                          \"CaptureTimetDelta\": 0,
                          \"DeltaTimeAuditLog\": 0,
                          \"ActiveUsers\": 52
                     }
                 }

     }"
| spath
| rename event.time as time
| spath path=event
| rename event.StatsMonitor.* as *
| table time ActiveUsers
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@brutecat

Can you please share sample events using precode block (101010 in text editor) ?

0 Karma

brutecat
Path Finder
    {
         "event":
                {
                "time": "2019-02-10T05:52:03",
                 "StatsMonitor": {
                         "time": "2019-02-10T05:52:03",
                         "name": "StatsMonitor",
                         "LocalTimetDelta": 0,
                         "CaptureTimetDelta": 0,
                         "DeltaTimeAuditLog": 0,
                         "ActiveUsers": 26
                    }
                }


    }

AND
    {
         "action":
                {
                     "StatsMonitor": {
                         "time": "2019-02-10T05:52:03",
                         "name": "StatsMonitor",
                         "LocalTimetDelta": 0,
                         "CaptureTimetDelta": 0,
                         "DeltaTimeAuditLog": 0,
                         "ActiveUsers": 26
                    }
                }
                ,
        "action":
                {
                     "StatsMonitorx": {
                         "time": "2019-01-10T06:52:03",
                         "name": "StatsMonitor",
                         "LocalTimetDelta": 0,
                         "CaptureTimetDelta": 0,
                         "DeltaTimeAuditLog": 0,
                         "ActiveUsers": 52
                    }
                }


    }
0 Karma

brutecat
Path Finder

Sorry - I realise the search was also cobbled. The asterisk was dropped:

index=conship | spath 
path=event.StatsMonitor
| rename event.time as time, event.StatsMonitor.* as *
| table time ActiveUsers
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...