<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Regarding nested json parsing at index time in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Regarding-nested-json-parsing-at-index-time/m-p/551635#M91555</link>
    <description>&lt;P&gt;I want to parse nested json at index time , what will be the props and trandform.I want separate all messages fields in seperate line&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;{&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;A href="https://172.29.1.52:8000/en-US/app/search/search?q=search%20index%3Dmain%20sourcetype%3D%22aws%3As3%22&amp;amp;display.page.search.mode=smart&amp;amp;dispatch.sample_ratio=1&amp;amp;workload_pool=&amp;amp;earliest=-4h%40m&amp;amp;latest=now&amp;amp;display.general.type=events&amp;amp;display.page.search.tab=events&amp;amp;sid=1621012763.1838_2F956D48-0E28-49A2-B9BE-927AB872A633#" target="_blank" rel="noopener"&gt;[-]&lt;/A&gt;&lt;SPAN&gt;&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;SPAN class="key level-1"&gt;&lt;SPAN class="key-name"&gt;id&lt;/SPAN&gt;:&amp;nbsp;&lt;SPAN class="t string"&gt;3614979212324797096956714454&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;SPAN class="key level-1"&gt;&lt;SPAN class="key-name"&gt;message&lt;/SPAN&gt;:&amp;nbsp;&lt;SPAN class="t string"&gt;{"@t":"2021-05-14T17:19:02.0149138Z","@m":"Upload metrics: \"{ duration = 81.9555, productCode = ct, tenantCode = , validBundle = True, validProductCode = True, validTenantCode = , bundleSize = 9670, successful = True }\"","@i":"0b918ffa","@l":"Information","@lt":"dev","metrics":"{ duration = 81.9555, productCode = ct, tenantCode = , validBundle = True, validProductCode = True, validTenantCode = , bundleSize = 9670, successful = True }","SourceContext":"Atlas.FhirStore.Api.Services.MetricsFhirResourceService","ActionId":"43adca80-545-4b1f-b9dd-d4008f3594b3","ActionName":"Atlas.FhirStore.Api.Controllers.FhirResourceController.UploadBundle (Atlas.FhirStore.Api)","RequestId":"0HM8MV64LIURF","RequestPath":"/api/v1/CT/bundle","SpanId":"|eb806e4b-47275043ec09ec97.2.a9d44dc9_","TraceId":"eb806e4b-47275043ec09ec97","ParentId":"|eb806e4b-47275043ec09ec97.2.","ThreadId":14,"X-Correlation-Id":"0HM8K136VRBAK:00000156","X-Correlation-Name":"IntegrationHubService"} &lt;/SPAN&gt;&lt;/SPAN&gt;&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;SPAN class="key level-1"&gt;&lt;SPAN class="key-name"&gt;timestamp&lt;/SPAN&gt;:&amp;nbsp;&lt;SPAN class="t number"&gt;1621012742015&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;}&lt;/SPAN&gt;&lt;/P&gt;</description>
    <pubDate>Fri, 14 May 2021 17:30:55 GMT</pubDate>
    <dc:creator>snehal</dc:creator>
    <dc:date>2021-05-14T17:30:55Z</dc:date>
    <item>
      <title>Regarding nested json parsing at index time</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Regarding-nested-json-parsing-at-index-time/m-p/551635#M91555</link>
      <description>&lt;P&gt;I want to parse nested json at index time , what will be the props and trandform.I want separate all messages fields in seperate line&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;{&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;A href="https://172.29.1.52:8000/en-US/app/search/search?q=search%20index%3Dmain%20sourcetype%3D%22aws%3As3%22&amp;amp;display.page.search.mode=smart&amp;amp;dispatch.sample_ratio=1&amp;amp;workload_pool=&amp;amp;earliest=-4h%40m&amp;amp;latest=now&amp;amp;display.general.type=events&amp;amp;display.page.search.tab=events&amp;amp;sid=1621012763.1838_2F956D48-0E28-49A2-B9BE-927AB872A633#" target="_blank" rel="noopener"&gt;[-]&lt;/A&gt;&lt;SPAN&gt;&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;SPAN class="key level-1"&gt;&lt;SPAN class="key-name"&gt;id&lt;/SPAN&gt;:&amp;nbsp;&lt;SPAN class="t string"&gt;3614979212324797096956714454&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;SPAN class="key level-1"&gt;&lt;SPAN class="key-name"&gt;message&lt;/SPAN&gt;:&amp;nbsp;&lt;SPAN class="t string"&gt;{"@t":"2021-05-14T17:19:02.0149138Z","@m":"Upload metrics: \"{ duration = 81.9555, productCode = ct, tenantCode = , validBundle = True, validProductCode = True, validTenantCode = , bundleSize = 9670, successful = True }\"","@i":"0b918ffa","@l":"Information","@lt":"dev","metrics":"{ duration = 81.9555, productCode = ct, tenantCode = , validBundle = True, validProductCode = True, validTenantCode = , bundleSize = 9670, successful = True }","SourceContext":"Atlas.FhirStore.Api.Services.MetricsFhirResourceService","ActionId":"43adca80-545-4b1f-b9dd-d4008f3594b3","ActionName":"Atlas.FhirStore.Api.Controllers.FhirResourceController.UploadBundle (Atlas.FhirStore.Api)","RequestId":"0HM8MV64LIURF","RequestPath":"/api/v1/CT/bundle","SpanId":"|eb806e4b-47275043ec09ec97.2.a9d44dc9_","TraceId":"eb806e4b-47275043ec09ec97","ParentId":"|eb806e4b-47275043ec09ec97.2.","ThreadId":14,"X-Correlation-Id":"0HM8K136VRBAK:00000156","X-Correlation-Name":"IntegrationHubService"} &lt;/SPAN&gt;&lt;/SPAN&gt;&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;SPAN class="key level-1"&gt;&lt;SPAN class="key-name"&gt;timestamp&lt;/SPAN&gt;:&amp;nbsp;&lt;SPAN class="t number"&gt;1621012742015&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;}&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 14 May 2021 17:30:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Regarding-nested-json-parsing-at-index-time/m-p/551635#M91555</guid>
      <dc:creator>snehal</dc:creator>
      <dc:date>2021-05-14T17:30:55Z</dc:date>
    </item>
    <item>
      <title>Re: Regarding nested json parsing at index time</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Regarding-nested-json-parsing-at-index-time/m-p/551683#M91561</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/231570"&gt;@snehal&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Can you please share your _raw which has multiple messages value in code format?&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2021-05-15 at 9.32.53 AM.png" style="width: 94px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/14157iEF9076A7355298AC/image-size/medium?v=v2&amp;amp;px=400" role="button" title="Screenshot 2021-05-15 at 9.32.53 AM.png" alt="Screenshot 2021-05-15 at 9.32.53 AM.png" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Sat, 15 May 2021 04:03:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Regarding-nested-json-parsing-at-index-time/m-p/551683#M91561</guid>
      <dc:creator>kamlesh_vaghela</dc:creator>
      <dc:date>2021-05-15T04:03:46Z</dc:date>
    </item>
  </channel>
</rss>

