Skip to main content
Solved

Use of Project with nested fields

  • Mar 11, 2025 3:12 AM UTC
  • 1 reply
  • 109 views

I have a field that is nested. I can search with the full name without an issue but when I try to use it with project, I do not get any values back. I have tried to wrap the field with single and double quotes. That results in the value for the field to be the name of the field.

The goal is to get a list of all the different values of the payload.comment.commentID field. What do I need to do to use the payload.comment.commentID field?

dataset="MyDataSet" sourcetype="MySourceType" payload.comment.commentID=* | project payload.comment.commentID

757_883b7ad0c2ed4615be34dd29d9308905.png757_82ad97f03f764e0c9a3cc07f98ceb471.png

Best answer by dritan

this is known and it’s getting addressed. One way around it for now is to assign it a different name e.g., ... | project foo=payload.comment.commentID

View original

    1 reply

    • dritan
    • Employee
    • Answer
    • Mar 11, 2025 4:47 AM UTC

    this is known and it’s getting addressed. One way around it for now is to assign it a different name e.g., ... | project foo=payload.comment.commentID

    Terms & ConditionsAccessibility statement