https://community.splunk.com/t5/Splunk-Search/How-to-extract-json-fields-from-json-inside-single-quotes/m-p/577964#M201397 <P>Hey I am having difficulties trying to extract fields from my splint logs. They are in the format of</P><P>’{“field”: “value1”, “field2”: “value2”}’ &nbsp;I’ve tried using spath but it doesn’t seem to work. I think the issue is that the json object is enclosed in single quotes so splunk doesn’t recognise it as json.&nbsp;</P> Fri, 10 Dec 2021 04:55:13 GMT Alanshiau717 2021-12-10T04:55:13Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-json-fields-from-json-inside-single-quotes/m-p/577964#M201397 <P>Hey I am having difficulties trying to extract fields from my splint logs. They are in the format of</P><P>’{“field”: “value1”, “field2”: “value2”}’ &nbsp;I’ve tried using spath but it doesn’t seem to work. I think the issue is that the json object is enclosed in single quotes so splunk doesn’t recognise it as json.&nbsp;</P> Fri, 10 Dec 2021 04:55:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-json-fields-from-json-inside-single-quotes/m-p/577964#M201397 Alanshiau717 2021-12-10T04:55:13Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-json-fields-from-json-inside-single-quotes/m-p/577965#M201398 <P>One solution is to rex the json out. &nbsp;Assuming that the sample data you give is _raw:</P><LI-CODE lang="markup">| rex "'(?&lt;jfield&gt;[^']+)" | spath input=jfield</LI-CODE><P>&nbsp;</P> Fri, 10 Dec 2021 05:14:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-json-fields-from-json-inside-single-quotes/m-p/577965#M201398 yuanliu 2021-12-10T05:14:34Z