https://community.splunk.com/t5/Getting-Data-In/Access-JSON-data/m-p/365879#M66591 <P>This tools with be help full to work with JSON data</P> <OL> <LI>JSON Formatter and Validator : <A href="https://jsonformatter.org">https://jsonformatter.org</A></LI> <LI>JSON Viewer <A href="https://codebeautify.org/jsonviewer">https://codebeautify.org/jsonviewer</A></LI> </OL> Thu, 05 Oct 2017 10:49:05 GMT jimmip 2017-10-05T10:49:05Z https://community.splunk.com/t5/Getting-Data-In/Access-JSON-data/m-p/365878#M66590 <P>This is in follow-up to <A href="https://answers.splunk.com/answers/578105/help-with-search-to-access-json-data.html#comment-577285" target="_blank">https://answers.splunk.com/answers/578105/help-with-search-to-access-json-data.html#comment-577285</A></P> <P>Please find the attached image for sample event.</P> <P>The query provided by is returning :- ABC.machine_cat:_attributes.ID.ABC.machine_cat</P> <P><CODE>&lt;&lt;FIELD&gt;&gt;</CODE><BR /> _attributes.ID.ABC.machine_cat</P> <P><CODE>&lt;&lt;MATCHSTR&gt;&gt;</CODE><BR /> ABC.machine_cat</P> <P>I want ABC.machine_cat : <CODE>&lt;&lt;VALURE of the machine_cat&gt;&gt;</CODE><BR /> Example: ABC.machine_cat : 01</P> <P><IMG src="https://community.splunk.com/storage/temp/216684-123.png" alt="alt text" /></P> Tue, 29 Sep 2020 16:01:20 GMT https://community.splunk.com/t5/Getting-Data-In/Access-JSON-data/m-p/365878#M66590 biec1 2020-09-29T16:01:20Z https://community.splunk.com/t5/Getting-Data-In/Access-JSON-data/m-p/365879#M66591 <P>This tools with be help full to work with JSON data</P> <OL> <LI>JSON Formatter and Validator : <A href="https://jsonformatter.org">https://jsonformatter.org</A></LI> <LI>JSON Viewer <A href="https://codebeautify.org/jsonviewer">https://codebeautify.org/jsonviewer</A></LI> </OL> Thu, 05 Oct 2017 10:49:05 GMT https://community.splunk.com/t5/Getting-Data-In/Access-JSON-data/m-p/365879#M66591 jimmip 2017-10-05T10:49:05Z