https://community.splunk.com/t5/Getting-Data-In/How-to-extract-json-fields/m-p/450551#M78206 <P>That's not valid json, but i wonder if that's because some characters have been stripped.<BR /> When you post raw text you should use the code formatter tool which looks like <CODE>101010</CODE></P> <P>Can you confirm if this data has been indexed as _json (it looks like maybe it has) in which case the fields may have been extracted already.</P> Wed, 20 Mar 2019 12:05:15 GMT nickhills 2019-03-20T12:05:15Z https://community.splunk.com/t5/Getting-Data-In/How-to-extract-json-fields/m-p/450550#M78205 <P>This is my Logs</P> <P>{ [-] <BR /> line: 2019-03-20T11:33:06.942Z info: Response: ServiceName: Pharmacy.findPharmacy; URI: /findpharmacy/; TranasactionStartTime: 1553081580; TransactionEndTime: 1553081586; StatusCode: 0000; refId: 50ab9d41ab2ee8abc0664f3f17a0df57;<BR /><BR /> source: stdout <BR /> tag: pharmacyv3caremark.2.6jus1ayt1c9ejdnxd1qi356lx;30997f60e91e;sit1-dtr.anthem.com/sit/pharmacyv3caremark:release-37@sha256:e1eb70168332a5f9ac9f1cdc5da83953087f507d254779a91cbc361b0e7ce872<BR /><BR /> }</P> <P>I need extract ServiceName TranasactionStartTime TransactionEndTime StatusCode refId</P> Wed, 20 Mar 2019 11:40:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-json-fields/m-p/450550#M78205 karthi2809 2019-03-20T11:40:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-extract-json-fields/m-p/450551#M78206 <P>That's not valid json, but i wonder if that's because some characters have been stripped.<BR /> When you post raw text you should use the code formatter tool which looks like <CODE>101010</CODE></P> <P>Can you confirm if this data has been indexed as _json (it looks like maybe it has) in which case the fields may have been extracted already.</P> Wed, 20 Mar 2019 12:05:15 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-json-fields/m-p/450551#M78206 nickhills 2019-03-20T12:05:15Z