How do I extract key value from below Json Sample.

vreddy22 — Thu, 25 Jan 2024 19:46:58 GMT

Hi All, I have a sample json event in Splunk as below. Please help me to understand how I can parse custom_tags value from below . This may have multiple key value pairs in it

{

account:xyz,

eventdate:01/25/2024,

properties: {

version:1.0,

requestID: cvv,

response: {"statusCode":"200", "result":"{\"run_id\":465253,\"custom_tags\":{\"jobname\":\"xyz\",\"domain\":\"bgg\"}}}

time:12:55

}

Re: How do I extract key value from below Json Sample.

ITWhisperer — Thu, 25 Jan 2024 20:39:50 GMT

Use spath for json data

| spath input=properties | spath input=response.result custom_tags | spath input=custom_tags

topic How do I extract key value from below Json Sample. in #Random

How do I extract key value from below Json Sample.

Re: How do I extract key value from below Json Sample.