Release v1.9.8

Bump version: 1.9.7 → 1.9.8

Release v1.9.7

• Update to the latest libraries:
  • Splunk Python sdk 1.7.4
  • jmespath 1.01
  • six (removed)
• Internally move to a new app template architecture making future updates easier.

Add Splunk 8 and Python 3 support

• Add support for Splunk 8 using Python 3. (earlier versions worked fine on Splunk 8, but used Python 2)
• Update python libraries:
  • jmespath 0.9.4 -> 0.10.0
  • splunk-sdk 1.6.6 -> 1.6.13
  • six 1.15.0 (new)
• Removed newlines from the jsonformat output=makeresults output. Whoops.
• Add Python 3 optimization for jsonformat order=preserve based on the fact that the dict data type now preserves order by default in Python 3.7 and later.
• Minor internal exception handling improvements
• Logging level is now WARNING by default (only impacts jsonformat) which should remove some noise in the internal logs. (More cleanup could be used here.)

5th public 2.0 preview release

• Several minor bug fixes.
• Added a new output mode to jsonformat that allows for the creation of run-anywhere examples. Use "output_mode=makeresults"
• Update jsonformat to use order preservation by default. (You can revert to the older, faster, behavior with "order=undefined").
• External library refresh: jmespath 0.9.4 and splunk-sdk 1.6.6
• Many docs updates and typo fixes.

Fourth public 2.0 release candidate

• Fix bug with mvlist inputs. (More of a just-dont-crash-workaround for the moment).
• Enhance output so that mvfields are only used as needed. Also eliminated the scenario where a single value could be unnecessarily wrapped in a single item list
  and therefore be returned as a JSON string.

Third public 2.0 release candidate

• Adds wildcard support for the output argument. This allows hashes to be expanded into multiple output fields in one invocation to jmespath
• Fixed bug in the unroll() function.
• Added support for quoting within the JMESpath expression, thus allowing support for keys that contain symbols.

Second public 2.0 release candidate - adds jsonformat

• Adds secondary search command: jsonformat
  • Supports formatting JSON events and/or fields, syntax validation, control over key ordering and so on.
  • (Also contains an Easter egg where it can convert a python repr string into a valid JSON object, helpful for debugging splunklib searchcommand logs.)
• Adds the Splunk Python SDK (1.6.5) for use with jsonformat and eventually jmespath.

First public 2.0 release candidate

• Add several custom functions to JMESPath core to simplify common Splunk data scenarios.
• BREAKING CHANGE: Switched to use spath style arguments instead of xpath style. (Technically a compatibility layer is in place, but I'm hoping not to keep that around too long.)
• Ensure that complex results are always returned as a JSON string, not as a python representation format. This allows subsequent processing with less hassle.
• Significant expansion of docs and UI feedback.

Add appIcon

Add appIcon.png images to resolve app inspect issue.

First stable Splunkbase release

First stable release

• Fixed various internal errors and enhanced stability
• Error messages are now reported to the user. Global errors (like a syntax issue, or attempting to use a non-existant function) will result in an error, whereas issues with individual events get logged to a hidden field _jmespath_error since often these can be safely ignored.
• The jmespath python library was update from 0.9.0 to 0.9.3 (latest stable release)

Under new management

I have many new features planned, but figured a proper 1.0.x stable release was worthwhile. The creator of this project no longer has time to maintain it, so I'm stepping in. I'm pulling the code to GitHub so anyone can contribute and pickup from where I left off, you know, in case I also don't release any updates for 2 years.

Please direct all issues and enhancements via GitHub issues. Or ping me @lowell on Splunk's usergroup Slack.

Why did I take this on? Because dealing with nested JSON objects in Splunk using nothing more than spath, mvexpand, and xyseries gets ugly very quickly. JMESPath can be a significant time saver, but a stable version and a few other enhancements are needed to make this truly helpful.