SPL
Expand JSON fields using spath
Description
0 0
index=<your JSON index>
| spath input=<your field w/ nested JSON data> path={}
| mvexpand {}
| spath input={}
GoSplunk SPL + dashboard repository
SPL
index=<your JSON index>
| spath input=<your field w/ nested JSON data> path={}
| mvexpand {}
| spath input={}
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.