https://community.splunk.com/t5/Dashboards-Visualizations/Why-am-I-unable-to-extract-JSON-fields/m-p/613204#M50300 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/240743">@POR160893</a>,</P><P>Just adding a spath should be enough.</P><LI-CODE lang="markup">index=firemon sourcetype=firemon:rules | spath</LI-CODE><P>&nbsp;</P> Thu, 15 Sep 2022 09:28:59 GMT scelikok 2022-09-15T09:28:59Z https://community.splunk.com/t5/Dashboards-Visualizations/Why-am-I-unable-to-extract-JSON-fields/m-p/613203#M50299 <P>Hi,</P> <P>&nbsp;</P> <P>I have an index where all the data is in JSON format and I am struggling to use Regex or spath to extract the fields:</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="POR160893_0-1663233134326.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/21482i8310CC17A282A0B9/image-size/medium?v=v2&amp;px=400" role="button" title="POR160893_0-1663233134326.png" alt="POR160893_0-1663233134326.png" /></span><BR /><BR />I have used this but I got it from Google and I do not understand why "msi" is being used:<BR />index=ABC sourcetype=DEF<BR />| rex field=_raw "(?msi)(?&lt;appNegated&gt;\{.+\}$)"<BR />| spath input=appNegated</P> <P>How can I extract each of these JSON-embedded fields as Splunk fields to be then used in a dashboard???<BR /><BR /><BR /><BR />Many thanks!</P> Thu, 15 Sep 2022 15:07:45 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Why-am-I-unable-to-extract-JSON-fields/m-p/613203#M50299 POR160893 2022-09-15T15:07:45Z https://community.splunk.com/t5/Dashboards-Visualizations/Why-am-I-unable-to-extract-JSON-fields/m-p/613204#M50300 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/240743">@POR160893</a>,</P><P>Just adding a spath should be enough.</P><LI-CODE lang="markup">index=firemon sourcetype=firemon:rules | spath</LI-CODE><P>&nbsp;</P> Thu, 15 Sep 2022 09:28:59 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Why-am-I-unable-to-extract-JSON-fields/m-p/613204#M50300 scelikok 2022-09-15T09:28:59Z