Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for building new JSON events with jmespath #18

Open
lowell80 opened this issue Nov 22, 2018 · 6 comments
Open

Add support for building new JSON events with jmespath #18

lowell80 opened this issue Nov 22, 2018 · 6 comments
Assignees
@lowell80
Labels
enhancement New feature or request
Milestone
Release 2.1

Comments

@lowell80
Copy link
Member

Consider allowing input= to be a wildcarded field as well. All of the field(s) that match would be passed in as top-level keys.

So if you had a single event with fields like this:

fields value
_raw ....
source ...
rec.name Joe
rec.kids Janet
Greg
Bob
rec.age 45

Could could run a command like so:

... | jmespath input=rec.* output=rec "{Name:name, Children:kids, Demographics:{age:to_number(age)}}"

And the output value for rec would looks something like:

{ "Name" : "Joe",
   "Children" : [ "Janet", "Greg", "Bob" ],
  "Demographics": { "age": 45 }
}

If one of the rec.* fields already contains a JSON string, then the from_string() function can be used to convert and, if necessary, further manipulate the record.

BTW: I'm not even sure the syntax of the JMESPath example is legit. Good luck future self!
@lowell80 lowell80 added the enhancement New feature or request label Nov 22, 2018
@lowell80 lowell80 self-assigned this Nov 22, 2018
@lowell80 lowell80 added this to the Release 2.1 milestone Nov 22, 2018
@lowell80
Copy link
Member Author

lowell80 commented Nov 3, 2022

Not sure we still need this given the json_* eval commands added in 8.0.
https://docs.splunk.com/Documentation/Splunk/9.0.2/SearchReference/JSONFunctions

@socamb
Copy link

socamb commented Nov 3, 2022 via email

@lowell80
Copy link
Member Author

lowell80 commented Nov 3, 2022

Scott, you are on the watchers list for this repo. That's why you are getting emails:
https://github.com/Kintyre/jmespath/watchers

I don't think I can remove you.

@socamb
Copy link

socamb commented Nov 3, 2022 via email

@brian-kennedy
Copy link

brian-kennedy commented Nov 3, 2022 via email

@socamb
Copy link

socamb commented Nov 3, 2022 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@lowell80 lowell80

Labels
enhancement New feature or request
Projects
None yet
Milestone
Release 2.1
Development

No branches or pull requests
3 participants
@brian-kennedy @lowell80 @socamb