https://community.splunk.com/t5/Feedback/extracting-nested-json/m-p/686611#M324 <P>you have to search and index the json by branch and nodes.&nbsp; If you need the SPL, let me know.</P> Mon, 06 May 2024 17:59:11 GMT youngsuh 2024-05-06T17:59:11Z https://community.splunk.com/t5/Feedback/extracting-nested-json/m-p/686591#M322 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="MichaelBs_1-1715008039869.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/30701i94A964EBF2C951DD/image-size/medium?v=v2&amp;px=400" role="button" title="MichaelBs_1-1715008039869.png" alt="MichaelBs_1-1715008039869.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="MichaelBs_2-1715008356513.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/30706i325DC18807070B67/image-size/medium?v=v2&amp;px=400" role="button" title="MichaelBs_2-1715008356513.png" alt="MichaelBs_2-1715008356513.png" /></span></P><P><BR /><BR />I am trying to extract the path as a field to do a lookup with it. I've tried but it doesn't work. I need help extracting that path. There are other paths in the data but need that particular path</P> Mon, 06 May 2024 15:15:57 GMT https://community.splunk.com/t5/Feedback/extracting-nested-json/m-p/686591#M322 MichaelBs 2024-05-06T15:15:57Z https://community.splunk.com/t5/Feedback/extracting-nested-json/m-p/686605#M323 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/33901">@yuanliu</a>&nbsp;</P> Mon, 06 May 2024 16:57:57 GMT https://community.splunk.com/t5/Feedback/extracting-nested-json/m-p/686605#M323 MichaelBs 2024-05-06T16:57:57Z https://community.splunk.com/t5/Feedback/extracting-nested-json/m-p/686611#M324 <P>you have to search and index the json by branch and nodes.&nbsp; If you need the SPL, let me know.</P> Mon, 06 May 2024 17:59:11 GMT https://community.splunk.com/t5/Feedback/extracting-nested-json/m-p/686611#M324 youngsuh 2024-05-06T17:59:11Z https://community.splunk.com/t5/Feedback/extracting-nested-json/m-p/686619#M326 <P>Is your data being interpreted by Splunk as JSON? Try expanding the event fields and seeing if it automatically extracts the json fields. If not, you'll have to change the indexing of the event so it is read as a JSON object. Then you can use SPATH or the auto-extracted fields to get the desired values.</P> Mon, 06 May 2024 19:40:20 GMT https://community.splunk.com/t5/Feedback/extracting-nested-json/m-p/686619#M326 marnall 2024-05-06T19:40:20Z https://community.splunk.com/t5/Feedback/extracting-nested-json/m-p/686669#M327 <P>I need the SPL</P> Tue, 07 May 2024 11:05:31 GMT https://community.splunk.com/t5/Feedback/extracting-nested-json/m-p/686669#M327 MichaelBs 2024-05-07T11:05:31Z https://community.splunk.com/t5/Feedback/extracting-nested-json/m-p/686670#M328 <P>Spath didn't give the right fields&nbsp;</P> Tue, 07 May 2024 11:24:33 GMT https://community.splunk.com/t5/Feedback/extracting-nested-json/m-p/686670#M328 MichaelBs 2024-05-07T11:24:33Z