Specific parameters and trace information in visualization table

[DarthHerm]

Both my work and myself are new to Splunk and I'm developing some reports and dashboards for one of our applications. 

This one dashboard I am working on includes a table of events showing when some reports are downloaded. The log file's sourcetype is _json_AuditFramework. I'm looking to include the parameters name @documentId and it's corresponding value to place into a table. Right now, the table syntax lists the parameters{}.value and when there's multiple parameters{}.name and parameters{}.values in the log, they will all show in the table. 

Pending on the report, I'm including trace information as well and it's the same thing as the parameters. I haven't had luck with similar posts I found. 

{"auditResultSets":null,"schema":"ref","storedProcedureName":"DocumentGetById","commandText":"ref.DocumentGetById","Locking":null,"commandType":4,"parameters":[{"name":"@RETURN_VALUE","value":0},{"name":"@DocumentId","value":123123}],"serverIPAddress":"100.100.100.100","serverHost":"WEBSERVER","clientIPAddress":"101.101.101.101","sourceSystem":"WebSite","module":"Vendor.PRODUCT.BLL.DocumentManagement","accessDate":"2025-03-06T17:26:47.4112974-07:00","userId":0000,"userName":"username","traceInformation":[{"type":"Page","class":"Vendor.PRODUCT.Web.UI.Website.DocumentManagement.ViewDocument","method":"Page_Load"},{"type":"Manager","class":"Vendor.PRODUCT.BLL.DocumentManagement.DocumentManager","method":"Get"}]}
Show syntax highlighted
host = WEBSERVER source = Logfile path sourcetype = _json_AuditFramework

[livehybrid]

Hi @DarthHerm 

I saw your message about doing field extractions, in the meantime have a look to see if this search helps?

index=your_index sourcetype=_json_AuditFramework
| spath input=parameters output=parameters
| spath input=traceInformation output=traceInformation
| eval param_names=mvmap(parameters, mvindex(mvfield(parameters{}.name), mvindex(mvfield(parameters{}.value), 0)))
| eval documentId=mvindex(mvfilter(match(param_names, "@DocumentId")), 1)
| eval trace_info=mvmap(traceInformation, mvindex(mvfield(traceInformation{}.type), mvindex(mvfield(traceInformation{}.class), mvindex(mvfield(traceInformation{}.method), 0))))
| table documentId, trace_info, serverIPAddress, serverHost, clientIPAddress, userName

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[DarthHerm]

Please disregard. Overthinking the issue and looking at setting up some field extractions.