Dashboards & Visualizations

Why am I unable to extract JSON fields?

POR160893
Builder

Hi,

 

I have an index where all the data is in JSON format and I am struggling to use Regex or spath to extract the fields:

POR160893_0-1663233134326.png

I have used this but I got it from Google and I do not understand why "msi" is being used:
index=ABC sourcetype=DEF
| rex field=_raw "(?msi)(?<appNegated>\{.+\}$)"
| spath input=appNegated

How can I extract each of these JSON-embedded fields as Splunk fields to be then used in a dashboard???



Many thanks!

Labels (1)
Tags (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @POR160893,

Just adding a spath should be enough.

index=firemon sourcetype=firemon:rules | spath

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @POR160893,

Just adding a spath should be enough.

index=firemon sourcetype=firemon:rules | spath

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...