Extracting last element?

[Manouchehri]

Is it possible to get the last field? e.g. instead of name.f4, could I do name.[-1]?

Desired command:

dap json + field_split_period name + where name.[-1] == com + json | jq

Similar command for future reference:

zcat /tyler/20170204-fdns.json.gz | head -10 | dap json + field_split_period name + where name.f4 == com + json | jq

[Manouchehri]

An alternative solution is to use the joined fields and use where [field] match [regex]. Would still be nice to have name.f[-1] or something though.

zcat /tyler/20170204-fdns.json.gz | head -10 | dap json + where name match .com$ + json | jq

[jhart-r7]

Good question. 🤔

Part of me wants to say that something like jq might be better suited for a task like this.

Strictly using dap, I don't think it can do this today, but perhaps with some modifications to field_split we could have it split into a list rather than a keyed hash like it does today. At least then you'd have a way to index through the results and programmatically know which is the last.

But, especially given that you aren't using any of the other split values you'd get from calling something like field_split_period, why not just use the where name match .com$ solution? That avoids updating the JSON record and is likely much faster. Combine that with a grep for .com even before calling dap is probably a good idea too.