<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Extract Json and Build a plot in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Extract-Json-and-Build-a-plot/m-p/438673#M94025</link>
    <description>&lt;P&gt;@jitin_ratra&lt;/P&gt;

&lt;P&gt;Can you please try this?&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;YOUR_SEARCH  | rex field=_raw "Message=Message :(?&amp;lt;json&amp;gt;.*)$" | eval _raw=json | kv | table LightweightProfile.Region LightweightProfile.Country LightweightProfile.CustomerSet ActionArguments.quoteNumber | rename "LightweightProfile.Region" as Region "LightweightProfile.Country" as Country "LightweightProfile.CustomerSet" as CustomerSet "ActionArguments.quoteNumber" as quoteNumber
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;&lt;STRONG&gt;My Sample Search:&lt;/STRONG&gt;&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults | eval _raw="Message=Message :{\"Application\": \"checkoutro\",\"UserAgent\": \"Mozilla/5.0\",\"RouteTemplate\": \"api/{c}/{l}/{cs}/v3quote/addquotetoprofile/{quoteNumber}\",\"RequestMethod\": \"POST\",\"ControllerName\": \"V3Quote\",\"ActionName\": \"AddQuoteToProfile\",\"ActionArguments\": {\"quoteNumber\": 12729883,\"version\": 1,\"source\": 5,\"customerNumber\": null},\"ActionReturnTypeFullName\": \"System.Web.Http.IHttpActionResult\",\"SessionId\": \"abc\",\"LightweightProfile\": {\"AccessGroup\": \"307b7c3e-e1a7-4366-9ed1-a77100b5973c\",\"AccessGroupType\": 0,\"ContentSegment\": \"bsd\",\"Country\": \"ZA\",\"CurrencyCode\": \"zar\",\"CurrencyCultureInfo\": null,\"CustomerSet\": \"RC1390756\",\"DisplayCultureInfo\": null,\"Language\": \"en\",\"ProfileId\": \"f2fa479b-3224-4d42-83ba-520e7416d6ee\",\"Region\": \"EMEA\",\"SalesSegment\": \"CHN\",\"SessionId\": \"abc\",\"LocalizedCatalogId\": 148,\"PricingTemplateId\": 0,\"IsGlobalPortal\": false,\"IsSiebelEnabledUsFedStore\": false} " | rex field=_raw "Message=Message :(?&amp;lt;json&amp;gt;.*)$" | eval _raw=json | kv | table LightweightProfile.Region LightweightProfile.Country LightweightProfile.CustomerSet ActionArguments.quoteNumber | rename "LightweightProfile.Region" as Region "LightweightProfile.Country" as Country "LightweightProfile.CustomerSet" as CustomerSet "ActionArguments.quoteNumber" as quoteNumber
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Thanks&lt;/P&gt;</description>
    <pubDate>Sun, 21 Oct 2018 18:33:12 GMT</pubDate>
    <dc:creator>kamlesh_vaghela</dc:creator>
    <dc:date>2018-10-21T18:33:12Z</dc:date>
    <item>
      <title>Extract Json and Build a plot</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Extract-Json-and-Build-a-plot/m-p/438672#M94024</link>
      <description>&lt;P&gt;I am looking to extract values from the Json to build out data to see what was the quote number that threw error. I am looking to build something like below. below is my Json &lt;/P&gt;

&lt;P&gt;Region | Country | CustomerSet | Quote Number&lt;BR /&gt;
EMEA    | ZA | RC1390756 | 12729883&lt;/P&gt;

&lt;P&gt;Message=Message :{&lt;BR /&gt;
  "Application": "checkoutro",&lt;BR /&gt;
  "UserAgent": "Mozilla/5.0",&lt;BR /&gt;
  "RouteTemplate": "api/{c}/{l}/{cs}/v3quote/addquotetoprofile/{quoteNumber}",&lt;BR /&gt;
  "RequestMethod": "POST",&lt;BR /&gt;
  "ControllerName": "V3Quote",&lt;BR /&gt;
  "ActionName": "AddQuoteToProfile",&lt;BR /&gt;
  "ActionArguments": {&lt;BR /&gt;
    "quoteNumber": 12729883,&lt;BR /&gt;
    "version": 1,&lt;BR /&gt;
    "source": 5,&lt;BR /&gt;
    "customerNumber": null&lt;BR /&gt;
  },&lt;BR /&gt;
  "ActionReturnTypeFullName": "System.Web.Http.IHttpActionResult",&lt;BR /&gt;
  "SessionId": "abc",&lt;BR /&gt;
  "LightweightProfile": {&lt;BR /&gt;
    "AccessGroup": "307b7c3e-e1a7-4366-9ed1-a77100b5973c",&lt;BR /&gt;
    "AccessGroupType": 0,&lt;BR /&gt;
    "ContentSegment": "bsd",&lt;BR /&gt;
    "Country": "ZA",&lt;BR /&gt;
    "CurrencyCode": "zar",&lt;BR /&gt;
    "CurrencyCultureInfo": null,&lt;BR /&gt;
    "CustomerSet": "RC1390756",&lt;BR /&gt;
    "DisplayCultureInfo": null,&lt;BR /&gt;
    "Language": "en",&lt;BR /&gt;
    "ProfileId": "f2fa479b-3224-4d42-83ba-520e7416d6ee",&lt;BR /&gt;
    "Region": "EMEA",&lt;BR /&gt;
    "SalesSegment": "CHN",&lt;BR /&gt;
    "SessionId": "abc",&lt;BR /&gt;
    "LocalizedCatalogId": 148,&lt;BR /&gt;
    "PricingTemplateId": 0,&lt;BR /&gt;
    "IsGlobalPortal": false,&lt;BR /&gt;
    "IsSiebelEnabledUsFedStore": false&lt;BR /&gt;
  }&lt;/P&gt;

&lt;P&gt;Any help will be appreciatd here . &lt;/P&gt;</description>
      <pubDate>Fri, 19 Oct 2018 12:30:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Extract-Json-and-Build-a-plot/m-p/438672#M94024</guid>
      <dc:creator>jitin_ratra</dc:creator>
      <dc:date>2018-10-19T12:30:27Z</dc:date>
    </item>
    <item>
      <title>Re: Extract Json and Build a plot</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Extract-Json-and-Build-a-plot/m-p/438673#M94025</link>
      <description>&lt;P&gt;@jitin_ratra&lt;/P&gt;

&lt;P&gt;Can you please try this?&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;YOUR_SEARCH  | rex field=_raw "Message=Message :(?&amp;lt;json&amp;gt;.*)$" | eval _raw=json | kv | table LightweightProfile.Region LightweightProfile.Country LightweightProfile.CustomerSet ActionArguments.quoteNumber | rename "LightweightProfile.Region" as Region "LightweightProfile.Country" as Country "LightweightProfile.CustomerSet" as CustomerSet "ActionArguments.quoteNumber" as quoteNumber
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;&lt;STRONG&gt;My Sample Search:&lt;/STRONG&gt;&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults | eval _raw="Message=Message :{\"Application\": \"checkoutro\",\"UserAgent\": \"Mozilla/5.0\",\"RouteTemplate\": \"api/{c}/{l}/{cs}/v3quote/addquotetoprofile/{quoteNumber}\",\"RequestMethod\": \"POST\",\"ControllerName\": \"V3Quote\",\"ActionName\": \"AddQuoteToProfile\",\"ActionArguments\": {\"quoteNumber\": 12729883,\"version\": 1,\"source\": 5,\"customerNumber\": null},\"ActionReturnTypeFullName\": \"System.Web.Http.IHttpActionResult\",\"SessionId\": \"abc\",\"LightweightProfile\": {\"AccessGroup\": \"307b7c3e-e1a7-4366-9ed1-a77100b5973c\",\"AccessGroupType\": 0,\"ContentSegment\": \"bsd\",\"Country\": \"ZA\",\"CurrencyCode\": \"zar\",\"CurrencyCultureInfo\": null,\"CustomerSet\": \"RC1390756\",\"DisplayCultureInfo\": null,\"Language\": \"en\",\"ProfileId\": \"f2fa479b-3224-4d42-83ba-520e7416d6ee\",\"Region\": \"EMEA\",\"SalesSegment\": \"CHN\",\"SessionId\": \"abc\",\"LocalizedCatalogId\": 148,\"PricingTemplateId\": 0,\"IsGlobalPortal\": false,\"IsSiebelEnabledUsFedStore\": false} " | rex field=_raw "Message=Message :(?&amp;lt;json&amp;gt;.*)$" | eval _raw=json | kv | table LightweightProfile.Region LightweightProfile.Country LightweightProfile.CustomerSet ActionArguments.quoteNumber | rename "LightweightProfile.Region" as Region "LightweightProfile.Country" as Country "LightweightProfile.CustomerSet" as CustomerSet "ActionArguments.quoteNumber" as quoteNumber
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Thanks&lt;/P&gt;</description>
      <pubDate>Sun, 21 Oct 2018 18:33:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Extract-Json-and-Build-a-plot/m-p/438673#M94025</guid>
      <dc:creator>kamlesh_vaghela</dc:creator>
      <dc:date>2018-10-21T18:33:12Z</dc:date>
    </item>
  </channel>
</rss>

