https://community.splunk.com/t5/Dashboards-Visualizations/Extract-data-from-field/m-p/689524#M56494 <P>Hello,&nbsp;</P><P>I receive an event of the following format:</P><P>{ log: { 'trace_id': 'abc', 'request_time': '2024-06-04 10:49:56.470140', 'log_type': 'DEBUG', 'message': 'hello'} }</P><P>Is it possible to extract from all the events I receive the inner JSON?</P><P>* each key in the inner json will be a column value but the me</P> Tue, 04 Jun 2024 11:27:15 GMT irisk 2024-06-04T11:27:15Z https://community.splunk.com/t5/Dashboards-Visualizations/Extract-data-from-field/m-p/689524#M56494 <P>Hello,&nbsp;</P><P>I receive an event of the following format:</P><P>{ log: { 'trace_id': 'abc', 'request_time': '2024-06-04 10:49:56.470140', 'log_type': 'DEBUG', 'message': 'hello'} }</P><P>Is it possible to extract from all the events I receive the inner JSON?</P><P>* each key in the inner json will be a column value but the me</P> Tue, 04 Jun 2024 11:27:15 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Extract-data-from-field/m-p/689524#M56494 irisk 2024-06-04T11:27:15Z https://community.splunk.com/t5/Dashboards-Visualizations/Extract-data-from-field/m-p/689525#M56495 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/268660">@irisk</a>&nbsp;,</P><P>did you tried to use INDEXED_EXTRACTIONS = json in your sourcetype?</P><P>Otherwise, did you already tried with spath command (<A href="https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Spath" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Spath</A>&nbsp;)?</P><P>Ciao.</P><P>Giuseppe</P> Tue, 04 Jun 2024 11:39:30 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Extract-data-from-field/m-p/689525#M56495 gcusello 2024-06-04T11:39:30Z https://community.splunk.com/t5/Dashboards-Visualizations/Extract-data-from-field/m-p/690109#M56544 <P>The problem was with the JSON because of the single quote instead of double quote, thanks for the help</P> Sun, 09 Jun 2024 06:47:50 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Extract-data-from-field/m-p/690109#M56544 irisk 2024-06-09T06:47:50Z https://community.splunk.com/t5/Dashboards-Visualizations/Extract-data-from-field/m-p/690118#M56545 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/268660">@irisk</a>&nbsp;,</P><P>good for you, see next time!</P><P>Ciao and happy splunking</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Sun, 09 Jun 2024 09:50:54 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Extract-data-from-field/m-p/690118#M56545 gcusello 2024-06-09T09:50:54Z