eval is failing to rename field

Question

i have corelight events which has id.orig_h ,id.resp_h etc fields , but when i try to rename them using eval src_ip=id.orig_h… it doesnt work , the RENAME fucntion works though, I dont want to use rename because i dont want to lose original fields , i also cant use corelight pack because it is also using rename , how can i rename without losing original field???

I don’t think you can use an eval with a nested field like that. Or better, it depends. If you have a JSON string you need to parse it and then do the eval.

Angelo Michele Pizzi · Answer

i have corelight events which has id.orig_h ,id.resp_h etc fields , but when i try to rename them using eval src_ip=id.orig_h… it doesnt work , the RENAME fucntion works though, I dont want to use rename because i dont want to lose original fields , i also cant use corelight pack because it is also using rename , how can i rename without losing original field???

I don’t think you can use an eval with a nested field like that. Or better, it depends. If you have a JSON string you need to parse it and then do the eval.

Sign up

Using your Cribl Curious or University Account

Login to the community

Using your Cribl Curious or University Account