topic Key/Value pairs from json are not showing up as fields in Getting Data In

Key/Value pairs from json are not showing up as fields

xvxt006 — Mon, 28 Sep 2020 14:43:09 GMT

We have the events in the below format and i was thinking i would see the fields without any extraction. But that did not happen. Do you know why?

ReadyToSubmitToFraud
PROCESSING_ERROR
SubmittedToFraud

2013-09-05 15:55:02,403 INFO 10.81.193.150 [AbstractOrderSubmitJob] {"order_status_counts":{"Fraud":"69","ReadyToSubmitToFraud":"962","PROCESSING_ERROR":"0","SubmittedToFraud":"13979"}}

Re: Key/Value pairs from json are not showing up as fields

lukejadamec — Fri, 06 Sep 2013 01:10:01 GMT

In short, you're using multiple delimiters in a single event, so Splunk needs a bit more information.

Try using spath in your search.

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Spath

Re: Key/Value pairs from json are not showing up as fields

xvxt006 — Fri, 06 Sep 2013 02:20:17 GMT

Thank you. I will read this doc.

Re: Key/Value pairs from json are not showing up as fields

jtworzydlo — Mon, 09 Sep 2013 10:59:59 GMT

The key/value pairs haven't been extracted because Splunk extracts automatically only key/value pairs in form: key=value.