Extract data from field

[irisk]

Hello, 

I receive an event of the following format:

{ log: { 'trace_id': 'abc', 'request_time': '2024-06-04 10:49:56.470140', 'log_type': 'DEBUG', 'message': 'hello'} }

Is it possible to extract from all the events I receive the inner JSON?

* each key in the inner json will be a column value but the me

[gcusello]

Hi @irisk ,

did you tried to use INDEXED_EXTRACTIONS = json in your sourcetype?

Otherwise, did you already tried with spath command (https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Spath )?

Ciao.

Giuseppe

[irisk · Accepted solution]

The problem was with the JSON because of the single quote instead of double quote, thanks for the help

[gcusello]

Hi @irisk ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉