https://community.splunk.com/t5/Splunk-Search/Working-with-a-json-string/m-p/651556#M225248 <P>Strings need to be in double quotes and embedded quotes need to be escaped</P><LI-CODE lang="markup">| eval data="{\"time\": \"2023-07-21T19:10:48+00:00\", \"pid\": 24086, \"msec\": 1689966648.059, \"remote_addr\": \"aaa.bbb.ccc.ddd\", \"request_time\": 0.005, \"host\": \"sitename.noname.org\", \"remote_user\": \"-\", \"request_filtered\": \"GET /healthz HTTP/1.1\", \"status\": 200, \"body_bytes_sent\": 13, \"bytes_sent\": 869, \"request_length\": 72, \"http_referer_filtered\": \"\", \"http_user_agent\": \"-\", \"http_x_forwarded_for\": \"-\", \"context\": \"973235423dccda96a385ca21c133891632a28d91\"}"</LI-CODE> Fri, 21 Jul 2023 20:36:42 GMT ITWhisperer 2023-07-21T20:36:42Z https://community.splunk.com/t5/Splunk-Search/Working-with-a-json-string/m-p/651554#M225247 <P>I've got a feed that is sending non-compliant json since spath doesn't work on it.&nbsp; I put together this search<BR /><BR /></P><LI-CODE lang="markup">index=dlp sourcetype=sft:json "{" | head 1 | eval data='{"time": "2023-07-21T19:10:48+00:00", "pid": 24086, "msec": 1689966648.059, "remote_addr": "aaa.bbb.ccc.ddd", "request_time": 0.005, "host": "sitename.noname.org", "remote_user": "-", "request_filtered": "GET /healthz HTTP/1.1", "status": 200, "body_bytes_sent": 13, "bytes_sent": 869, "request_length": 72, "http_referer_filtered": "", "http_user_agent": "-", "http_x_forwarded_for": "-", "context": "973235423dccda96a385ca21c133891632a28d91"}' | spath input=data</LI-CODE><P>I'm not seeing any value for data, thus nothing for the spath.&nbsp; Do I need to do something special to the eval to get it to process?</P><P>TIA,</P><P>Joe</P> Fri, 21 Jul 2023 20:14:50 GMT https://community.splunk.com/t5/Splunk-Search/Working-with-a-json-string/m-p/651554#M225247 jwhughes58 2023-07-21T20:14:50Z https://community.splunk.com/t5/Splunk-Search/Working-with-a-json-string/m-p/651556#M225248 <P>Strings need to be in double quotes and embedded quotes need to be escaped</P><LI-CODE lang="markup">| eval data="{\"time\": \"2023-07-21T19:10:48+00:00\", \"pid\": 24086, \"msec\": 1689966648.059, \"remote_addr\": \"aaa.bbb.ccc.ddd\", \"request_time\": 0.005, \"host\": \"sitename.noname.org\", \"remote_user\": \"-\", \"request_filtered\": \"GET /healthz HTTP/1.1\", \"status\": 200, \"body_bytes_sent\": 13, \"bytes_sent\": 869, \"request_length\": 72, \"http_referer_filtered\": \"\", \"http_user_agent\": \"-\", \"http_x_forwarded_for\": \"-\", \"context\": \"973235423dccda96a385ca21c133891632a28d91\"}"</LI-CODE> Fri, 21 Jul 2023 20:36:42 GMT https://community.splunk.com/t5/Splunk-Search/Working-with-a-json-string/m-p/651556#M225248 ITWhisperer 2023-07-21T20:36:42Z