Feedback:

spath

Use the spath operator to read in information from an XML or JSON file specified by a location path expression.

Syntax

|spath [input=<field>] [output=<field>] [path=<datapath>|<datapath>]

[input=<field>]

Specify the field from the source file to read in.
[output=<field>]

Specify the field to write to in search results. If you do not specify the output field name, the field name is derived from the specified location path.
[path=<datapath>|<datapath>]

Specify the location path. You can explicitly specify the path= option or not. If it is not specified, AQL can still interpret a path specified after the field arguments as a path argument.

Use a dot-separated hierarchy to specify the location steps in the datapath.

A location step is a field name and optional index that refers to the position of the data in an array. For example: parent.child{2} refers to the second child in the hierarchy.

Use the @ symbol to specify an XML attribute. For example: parent.child{@type} identifies the XML location for information that distinguishes children of adult age and minor children:

<parent>

<child age="adult">Alice</child>

<child age="minor">Bob</child>

</parent>

Usage

You can use the spath operator to read in information from an XML or JSON file.

Examples

Example 1: Extract a nested field from JSON or XML data using explicit path syntax.

Copy 
|spath output=locDesc path=vendorProductSet.product.desc.locDesc

Example 2: Extract a nested field from a specified input field.

Copy 
|spath input=json_field output=myfield vendorProductSet.product.desc

Example 3: Extract nested data with implicit path syntax.

Copy 
|spath input=json_field output=myfield event.sou

Example 4: Counts daily Fortinet product events, then pivots the result so each date becomes a column and each row represents a product.

Copy 
ocsf | where metadata.product.name contains 'Forti' | calc Date=strftime(event_time, '%Y-%m-%d') | aggr count as cnt by metadata.product.name, Date | transpose row=metadata.product.name col=Date