topic Re: Extract json fields in Getting Data In

Extract json fields

falcon — Fri, 02 Jan 2026 08:55:50 GMT

I have multiple fields under the interesting fields section named field1, field2, field3, and so on. Each of these fields contains a JSON key–value pair. I also have other fields that are already properly extracted and do not follow this field1, field2 pattern.

How can I extract values from these field1, field2, etc. fields? For example, if field1 contains {"username": "testUser"}, how can I filter for the value "testUser"? The raw data looks fine json logs.

Re: Extract json fields

ITWhisperer — Fri, 02 Jan 2026 10:11:36 GMT

You can use spath, for example:

| spath input=field1

Re: Extract json fields

gcusello — Fri, 02 Jan 2026 11:03:16 GMT

Hi @falcon ,

at first use INDEXED_EXTRACTIONS = JSON in the sourcetype definition and then use, as @ITWhisperer said, the spath command (for more infos see at ( https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/9.0/search-commands/spath ).

Ciao.

Giuseppe

Re: Extract json fields

isoutamo — Fri, 02 Jan 2026 16:50:24 GMT

It should works as already said.

If it didn't work then maybe you have too long json event or it something like json but not exactly.

Please give some more information to us if needed.

Re: Extract json fields

PickleRick — Fri, 02 Jan 2026 21:51:40 GMT

Wait.

1. Indexed extractions have nothing to do with spath command. And as I understand the question, only parts of the original event form json structures, not the whole raw event. In this case indexed extractions won't work anyway.

2. As a rule of thumb, indexed extractions shouldn't be used unless there is no other way.