spath

This command is experimental

Definition

spath extracts information from table columns that contain XML or JSON. The extracted structured data is stored in separate table columns.

You can use spath() evaluation with eval command.

Examples

Use spath to extract information from XML or JSON content from _raw table column.

%dpl
index=crud_small earliest=01/01/2021:00:00:00
| spath
example of basic spath

Extracted information are put in their own table columns which need to be toggled visible from the column visibility drop-down menu.

Input

You can define from which table column the information is extracted with input argument. By default, the information is extracted from _raw table column.

%dpl
index=crud_small earliest=01/01/2021:00:00:00
| spath input=_raw
input example

Path

You can define which part of XML or JSON content is extracted into its own table column with path argument.

%dpl
index=crud_small earliest=01/01/2021:00:00:00
| spath path=operation
path example

Output

If you use path argument, you can define in which table column the value is extracted with output argument.

%dpl
index=crud_small earliest=01/01/2021:00:00:00
| spath path=ipaddress output="IP Address"
output example

Further Reading