Tutorial

Tutorial

There are many "run-anywhere" examples on these pages to enable new users to quickly grasp and test-out new concepts with minimal effort. Feel free to review these as you browse around. We encourage new users to test these out themselves as soon as possible, there's no substitute for hands-on experience and installation is easy. And the benefit of run-anywhere examples is that you don't have to configure ingestion or subscribe to a particular service to try these out. This works great on a local test instance of Splunk.

A full list of the tutorial topic are available on the right-side navigation bar.

How do I use a "Run-anywhere" example?

Simply copy-n-paste the entire example into your Splunk search bar. You should be able to see the results within a few seconds. On thing to note is that many of these examples are long and sometimes they are on a single line. Be sure to copy the entire example.

Nearly all of these do require that you have already install jmespath in your Splunk environment first.

First example

Here's a trivial example to get you started:

| makeresults | eval _raw="{\"doc\":{\"jmespath\":\"JMESPath rocks\"}}"
| jmespath output=newfield doc.jmespath | table newfield