https://community.splunk.com/t5/Splunk-Search/Splunk-query-How-to-use-spath-command-for-the-below-logs/m-p/597617#M208074 <P>Sorry, I forgot you need to deal with multiline values</P><LI-CODE lang="markup">| rex "(?ms)Error log: (?&lt;json&gt;\{.*\})" | spath input=json</LI-CODE> Thu, 12 May 2022 14:26:36 GMT ITWhisperer 2022-05-12T14:26:36Z https://community.splunk.com/t5/Splunk-Search/Splunk-query-How-to-use-spath-command-for-the-below-logs/m-p/597587#M208064 <P>How to use spath command for the below logs i have attached in the screenshot.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="IMG_20220512_184747__01__01.jpg" style="width: 2590px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/19609i5A58C3E44268475D/image-size/medium?v=v2&amp;px=400" role="button" title="IMG_20220512_184747__01__01.jpg" alt="IMG_20220512_184747__01__01.jpg" /></span></P> <P> </P> Thu, 12 May 2022 14:22:05 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-query-How-to-use-spath-command-for-the-below-logs/m-p/597587#M208064 uagraw01 2022-05-12T14:22:05Z https://community.splunk.com/t5/Splunk-Search/Splunk-query-How-to-use-spath-command-for-the-below-logs/m-p/597591#M208066 <LI-CODE lang="markup">| rex "Error log: (?&lt;json&gt;\{.*\})" | spath input=json</LI-CODE> Thu, 12 May 2022 13:50:26 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-query-How-to-use-spath-command-for-the-below-logs/m-p/597591#M208066 ITWhisperer 2022-05-12T13:50:26Z https://community.splunk.com/t5/Splunk-Search/Splunk-query-How-to-use-spath-command-for-the-below-logs/m-p/597602#M208069 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;Thanks for your reply but it is Not working for me.</P> Thu, 12 May 2022 14:07:35 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-query-How-to-use-spath-command-for-the-below-logs/m-p/597602#M208069 uagraw01 2022-05-12T14:07:35Z https://community.splunk.com/t5/Splunk-Search/Splunk-query-How-to-use-spath-command-for-the-below-logs/m-p/597603#M208070 <P>What are you getting in the json field?</P> Thu, 12 May 2022 14:09:30 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-query-How-to-use-spath-command-for-the-below-logs/m-p/597603#M208070 ITWhisperer 2022-05-12T14:09:30Z https://community.splunk.com/t5/Splunk-Search/Splunk-query-How-to-use-spath-command-for-the-below-logs/m-p/597610#M208071 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp; I think rex is not properly working.</P> Thu, 12 May 2022 14:19:06 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-query-How-to-use-spath-command-for-the-below-logs/m-p/597610#M208071 uagraw01 2022-05-12T14:19:06Z https://community.splunk.com/t5/Splunk-Search/Splunk-query-How-to-use-spath-command-for-the-below-logs/m-p/597613#M208072 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;I have tried this and now it is working fine.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="IMG_20220512_195036__01.jpg" style="width: 2722px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/19611i92057E9E1188C07D/image-size/medium?v=v2&amp;px=400" role="button" title="IMG_20220512_195036__01.jpg" alt="IMG_20220512_195036__01.jpg" /></span></P> Thu, 12 May 2022 14:21:40 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-query-How-to-use-spath-command-for-the-below-logs/m-p/597613#M208072 uagraw01 2022-05-12T14:21:40Z https://community.splunk.com/t5/Splunk-Search/Splunk-query-How-to-use-spath-command-for-the-below-logs/m-p/597617#M208074 <P>Sorry, I forgot you need to deal with multiline values</P><LI-CODE lang="markup">| rex "(?ms)Error log: (?&lt;json&gt;\{.*\})" | spath input=json</LI-CODE> Thu, 12 May 2022 14:26:36 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-query-How-to-use-spath-command-for-the-below-logs/m-p/597617#M208074 ITWhisperer 2022-05-12T14:26:36Z