Change Log

Pre 2.0 releases

• 1.9.8 (June 10, 2024) Permissions fix

  • Change permissions for the 'jmespath' and 'jsonformat' command so that all users to run them, not just users that inherit the default 'users' role. (Bug found & fixed by Paul Wernau)

• 1.9.7 (September 21, 2023) Internal re-packaging and library updates

• Update Splunk SDK to 1.74

• Jmespath 1.0.1

• Optimization/fix by Alessandro Serpi.

• 1.9.6 (July 17, 2020) - Python 3 by default

• 1.9.5 (July 17, 2020) Splunk 8 support

  • Add support for Splunk 8 using Python 3. (earlier versions worked fine on Splunk 8, but used Python 2)
  • Update python libraries:
    • jmespath 0.9.4 -> 0.10.0
    • splunk-sdk 1.6.6 -> 1.6.13
    • six 1.15.0 (new)
  • Removed newlines from the jsonformat output=makeresults output. Whoops.
  • Add Python 3 optimization for jsonformat order=preserve.
  • Minor internal exception handling improvements
  • Logging level is now WARNING by default; less noise.

• 1.9.4 (March 20, 2019) Fifth public 2.0 release candidate

  • Several minor bug fixes.
  • Added a new output mode to jsonformat that allows for the creation of run-anywhere examples. Use output_mode=makeresults
  • Update jsonformat to use order preservation by default. (You can revert to the older, faster, behavior with order=undefined).
  • External library refresh: jmespath 0.9.4 and splunk-sdk 1.6.6
  • Many docs updates and typo fixes.

• 1.9.4 (Nov 14, 2018) Fourth public 2.0 release candidate

  • Fix bug with mvlist inputs. (More of a just-dont-crash-workaround for the moment).
  • Enhance output so that mvfields are only used as needed. Also eliminated the scenario where a single value could be unnecessarily wrapped in a single item list and therefore be returned as a JSON string.

• 1.9.3 (Nov 13, 2018) Third public 2.0 release candidate

  • Adds wildcard support for the output argument. This allows hashes to be expanded into multiple output fields in one invocation to jmespath
  • Fixed bug in the unroll() function.
  • Added support for quoting within the JMESpath expression, thus allowing support for keys that contain symbols.

• 1.9.2 (Nov 13, 2018) Second public 2.0 release candidate

  • Adds secondary search command: jsonformat
  • Supports formatting JSON events and/or fields, syntax validation, control over key ordering and so on. (Also contains an Easter egg where it can convert a python repr string into a valid JSON object, helpful for debugging splunklib searchcommand logs.)
  • Adds the Splunk Python SDK (1.6.5) for use with jsonformat and eventually jmespath.

• 1.9.1 (Nov 12, 2018) First public 2.0 release candidate

  • Add several custom functions to JMESPath core to simplify common Splunk data scenarios.
  • BREAKING CHANGE: Switched to use spath style arguments instead of xpath style. (Technically a compatibility layer is in place, but I'm hoping not to keep that around too long.)
  • Ensure that complex results are always returned as a JSON string, not as a python representation format. This allows subsequent processing with less hassle.
  • Significant expansion of docs and UI feedback.

Legacy 1.0 releases

• 1.0.2 (Nov 9, 2018) - Added logo

  • Add appIcon images to avoid AppInspect violations

• 1.0.1 (Nov 9, 2018) - Lowell's first release (stability of existing code)

  • Upgraded jmsepath python library to 0.9.3
  • Added error reporting for JMESpath errors (JSON decoding errors are still silently ignored)
  • Fixed bug where 'default' would overwrite query output
  • Add inline help and hints to the UI (searchbnf)

• 1.0 RC2 (July 26, 2016) - Pre-release by John Berwick

  • Add flatten procedure

• 1.0 RC (July 24, 2016) - Pre-release by John Berwick

  • First public release