https://community.splunk.com/t5/Splunk-Search/how-to-convert-JSON-property-of-event-to-string/m-p/601405#M209308 <P>Thank you so much!</P> Fri, 10 Jun 2022 18:25:48 GMT Mayukh 2022-06-10T18:25:48Z https://community.splunk.com/t5/Splunk-Search/how-to-convert-JSON-property-of-event-to-string/m-p/601399#M209306 <P>Hello,</P> <P>I have a HEC with events like the following:</P> <P>&nbsp;</P> <LI-CODE lang="markup">{ "Log": { "Status": "Ordered", "Platform": { "A": { "Tracking": {"Field1": "Value1", "Field2": "Value2"} } } } }</LI-CODE> <P>&nbsp;</P> <P>When I run the query</P> <P>&nbsp;</P> <LI-CODE lang="markup">index="my_index" AND Log.Status="Ordered" | table Log.Status Log.Platform.A.Tracking</LI-CODE> <P>&nbsp;</P> <UL> <LI>I get all the data for Status.</LI> <LI>However my requirement is to have the JSON object Log.Platform.A.Tracking in a string format - the JSON as a String?</LI> </UL> <P>How can I achieve this?</P> Fri, 10 Jun 2022 18:58:20 GMT https://community.splunk.com/t5/Splunk-Search/how-to-convert-JSON-property-of-event-to-string/m-p/601399#M209306 Mayukh 2022-06-10T18:58:20Z https://community.splunk.com/t5/Splunk-Search/how-to-convert-JSON-property-of-event-to-string/m-p/601402#M209307 <LI-CODE lang="markup">| spath path=Log.Status output=Status | spath path=Log.Platform.A.Tracking output=Tracking | table Status Tracking</LI-CODE> Fri, 10 Jun 2022 18:15:13 GMT https://community.splunk.com/t5/Splunk-Search/how-to-convert-JSON-property-of-event-to-string/m-p/601402#M209307 ITWhisperer 2022-06-10T18:15:13Z https://community.splunk.com/t5/Splunk-Search/how-to-convert-JSON-property-of-event-to-string/m-p/601405#M209308 <P>Thank you so much!</P> Fri, 10 Jun 2022 18:25:48 GMT https://community.splunk.com/t5/Splunk-Search/how-to-convert-JSON-property-of-event-to-string/m-p/601405#M209308 Mayukh 2022-06-10T18:25:48Z