spath
Description
Performs a search on XML or JSON strings.
Syntax
spath [input=<field>] [output=<field>] path=<datapath>
Required Arguments
| Parameter | Syntax | Description |
|---|---|---|
input | <field> | Name of the field containing the XML/JSON string. |
path | path=<query> | The search pattern for finding the value in XML/JSON. |
Optional Arguments
| Parameter | Syntax | Default | Description |
|---|---|---|---|
output | <field> | The name of the field to store the retrieved value. |
Query Examples
Example 1
In this example, the system will return the value of sourcetype in the field myVals.
... | spath input=raw_event output=myVals path=sourcetype
Example 2
In this example, the system will return the first item in the desc array in the desc field.
... | path input=hello path=vendorProductSet.product.desc{1}
Example 3
In this example, the system will return the @locale attribute of the first item in the desc array in the desc field.
... | path input=hello path=vendorProductSet.product.desc{1}.locDesc{@locale}