Minor tweaks

- Switch jsonformat to use 'preserve' as the default order.
- Minor comment cleanups and exception message tweaks for jmespath.

bin/jpath.py

@@ -18,7 +18,6 @@ class JmesPathSplunkExtraFunctions(functions.Functions):
     def _func_items(self, h):
         """ JMESPath includes a keys() and a values(), but with unordered objects, there's no way
         to line these up!  So this feels like an pretty obvious extension to a Python guy! """
-        #return [ [k,v] for k,v in h.items() ]
         return list(h.items())
 
     @functions.signature({'types': ['array']})
@@ -45,7 +44,6 @@ def _func_from_string(self, s):
             unnest          Can't get past the double "n"s
             jsonstr         My first option, but don't like it.
         """
-        # XXX: Figure out how to make this properly support (pass-through) a 'null' type
         if s is None:
             return None
         if isinstance(s, (list,tuple)):
@@ -88,7 +86,7 @@ def _func_unroll(self, objs, key, value):
                 continue
             except Exception as e:
                 # FOR DEBUGGING ONLY
-                return "ERROR:  Couldn't find key={} value={} in {}".format(key, value, item)
+                return "ERROR:  {}  key={} value={} in {}".format(e, key, value, item)
         return d
 
 
@@ -125,11 +123,10 @@ def output_to_field(values, output, record):
         record[output] = None
     elif len(content) == 1:
         # Avoid the overhead of MV field encoding
-        content  = content[0]
+        content = content[0]
     record[output] = content
 
 
-
 def output_to_wildcard(values, output, record):
     output_template = output.replace("*", "{}", 1)
     if values is None:
@@ -171,7 +168,7 @@ def legacy_args_fixer(options):
             options[n_arg] = options[o_arg]
 
 
-if __name__ == '__main__':
+def jpath():
     try:
         keywords, options = si.getKeywordsAndOptions()
         legacy_args_fixer(options)
@@ -240,3 +237,7 @@ def legacy_args_fixer(options):
 
         stack = traceback.format_exc()
         si.generateErrorResults("Error '%s'. %s" % (e, stack))
+
+
+if __name__ == '__main__':
+    jpath()

bin/jsonformat.py

@@ -35,7 +35,7 @@ class JsonFormatCommand(StreamingCommand):
 
     order = Option(
         doc="Pick order options.  undefined (default), preserve, or sort.  Only impacts hash order",
-        require=False, default="undefined", validate=validators.Set("undefined", "preserve", "sort"))
+        require=False, default="preserve", validate=validators.Set("undefined", "preserve", "sort"))
 
     errors = Option(
         doc="field name to capture any parsing error messages.",

default/searchbnf.conf

@@ -66,11 +66,10 @@ tags = json
 [jsonformat-order-option]
 syntax = order=(undefined|preserve|sort)
 description = \
-    If order is UNDEFINED, no sorting or preservation of hash order will be kept. Default because JSON says hash key \
-    order is irrelevant. \
-     If order is PRESERVE then the representation order is preserved in the formatted output. \
-     If order is SORT then all hash keys are sorted lexicographically.   This gives a more consistent result.
-default = "order=undefined"
+    If order is UNDEFINED, no sorting or preservation of hash order will be kept.  This is a bit faster. \
+    If order is PRESERVE then the representation order is preserved in the formatted output.  This is the default because it's what most people want. \
+    If order is SORT then all hash keys are sorted lexicographically.   This gives a more consistent result.
+default = "order=preserve"
 
 [jsonformat-input_mode-option]
 syntax = input_mode=(json|python)