Seeing the Results

We've modified the data in flight, and now we want to look at the result.

important

View the Resulting Events

1. In the terminal, copy/paste the same command we started with (or just press your Up Arrow key to restore it):

cat $(ls -t /tmp/employee/CriblOut-* | head -n 1)

You should now see something like this:

Notice that in this more orderly data, we now have many smaller events that include only a few typical event fields:

_time, sourcetype, cribl_pipe

...along with a single, flattened employee object:

FirstName, LastName, Id, Role_Department, Role_Type

And no data is nested.

That's it, we've completed our mission...