Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support quote on the output field #22

Open
lowell80 opened this issue Dec 7, 2018 · 2 comments
Open

Support quote on the output field #22

lowell80 opened this issue Dec 7, 2018 · 2 comments
Assignees
@lowell80
Labels
bug Something isn't working
Milestone
Release 2.0

Comments

@lowell80
Copy link
Member

lowell80 commented Dec 7, 2018

Support a command like this:

sourcetype="ms:o365:management AzureActiveDirectory | jmespath output="Actor.Type[*]" "unroll(Actor, 'Type', 'ID')"

Right now this works, but it creates a field with double quotes around it. DOH! We also want to be able to support fields that could contain a whitespace character (event though that's bad form).

The current workaround is follow this up with an extra rename operation, which shouldn't be necessary.
@lowell80 lowell80 added the bug Something isn't working label Dec 7, 2018
@lowell80 lowell80 added this to the Release 2.0 milestone Dec 7, 2018
@lowell80 lowell80 self-assigned this Dec 7, 2018
@lowell80
Copy link
Member Author

See if #9 solves this.

@lowell80
Copy link
Member Author

lowell80 commented Feb 8, 2020

Still broken in 1.9.5:

| jmespath output="inquiry_type" "fields[?title=='Inquiry Type'].value"

Produces the field "inquiry_type" (with quotes)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@lowell80 lowell80

Labels
bug Something isn't working
Projects
None yet
Milestone
Release 2.0
Development

No branches or pull requests
1 participant
@lowell80