Extracting last element? about dap HOT 2 CLOSED

An alternative solution is to use the joined fields and use where [field] match [regex]. Would still be nice to have name.f[-1] or something though.

zcat /tyler/20170204-fdns.json.gz | head -10 | dap json + where name match .com$ + json | jq

from dap.

Good question. 🤔

Part of me wants to say that something like jq might be better suited for a task like this.

Strictly using dap, I don't think it can do this today, but perhaps with some modifications to field_split we could have it split into a list rather than a keyed hash like it does today. At least then you'd have a way to index through the results and programmatically know which is the last.

But, especially given that you aren't using any of the other split values you'd get from calling something like field_split_period, why not just use the where name match .com$ solution? That avoids updating the JSON record and is likely much faster. Combine that with a grep for .com even before calling dap is probably a good idea too.

from dap.