https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-from-json-format-event/m-p/670923#M229957 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="nehamvinchankar_0-1701833361480.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/28387i56BACE54CC4C1E11/image-size/medium?v=v2&amp;px=400" role="button" title="nehamvinchankar_0-1701833361480.png" alt="nehamvinchankar_0-1701833361480.png" /></span></P><P>details field is blank</P> Wed, 06 Dec 2023 03:29:38 GMT nehamvinchankar 2023-12-06T03:29:38Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-from-json-format-event/m-p/670825#M229925 <P>Hi all, i want to extract fields from event which is in json format<BR /><BR /></P> <LI-CODE lang="markup">INFO [processor: anchsdgeiskgcbc/5; event: 1-57d28402-9058-11ee-83b7-021a6f9d1f1c] : DETAILS: [ { "ERROR_MESSAGE": "\nError: abchdvshsuaajs.\n", "NUMBER": "123r57", "DB_TIMESTAMP": "2023-11-30" }, { "ERROR_MESSAGE": "\nError: ehwegagsuabajehss.\n", "NUMBER": "63638w82u", "DB_TIMESTAMP": "2023-11-30" }, and similarly we have these error data in one event Fields to be extracted - ERROR_MESSAGE NUMBER DB_TIMESTAMP</LI-CODE> <P><BR /><BR /><BR /></P> Tue, 05 Dec 2023 15:07:29 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-from-json-format-event/m-p/670825#M229925 nehamvinchankar 2023-12-05T15:07:29Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-from-json-format-event/m-p/670842#M229930 <P>Given that this doesn't appear to be wholly correct JSON, you could start with something like this</P><LI-CODE lang="markup">| rex "DETAILS: (?&lt;details&gt;\[.*\])" | spath input=details </LI-CODE> Tue, 05 Dec 2023 14:19:21 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-from-json-format-event/m-p/670842#M229930 ITWhisperer 2023-12-05T14:19:21Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-from-json-format-event/m-p/670855#M229936 <P>no this is not working</P><P>&nbsp;</P> Tue, 05 Dec 2023 15:09:45 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-from-json-format-event/m-p/670855#M229936 nehamvinchankar 2023-12-05T15:09:45Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-from-json-format-event/m-p/670859#M229937 <P>What results do you get then?</P> Tue, 05 Dec 2023 15:19:29 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-from-json-format-event/m-p/670859#M229937 ITWhisperer 2023-12-05T15:19:29Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-from-json-format-event/m-p/670923#M229957 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="nehamvinchankar_0-1701833361480.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/28387i56BACE54CC4C1E11/image-size/medium?v=v2&amp;px=400" role="button" title="nehamvinchankar_0-1701833361480.png" alt="nehamvinchankar_0-1701833361480.png" /></span></P><P>details field is blank</P> Wed, 06 Dec 2023 03:29:38 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-from-json-format-event/m-p/670923#M229957 nehamvinchankar 2023-12-06T03:29:38Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-from-json-format-event/m-p/670954#M229963 <P>Try this</P><LI-CODE lang="markup">| rex "(?ms)DETAILS: (?&lt;details&gt;\[.*\])" | spath input=details </LI-CODE> Wed, 06 Dec 2023 08:39:10 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-from-json-format-event/m-p/670954#M229963 ITWhisperer 2023-12-06T08:39:10Z