Why am I unable to extract JSON fields?

[POR160893]

Hi,

I have an index where all the data is in JSON format and I am struggling to use Regex or spath to extract the fields:

I have used this but I got it from Google and I do not understand why "msi" is being used:
index=ABC sourcetype=DEF
| rex field=_raw "(?msi)(?<appNegated>\{.+\}$)"
| spath input=appNegated

How can I extract each of these JSON-embedded fields as Splunk fields to be then used in a dashboard???



Many thanks!

[scelikok · Accepted solution]

Hi @POR160893,

Just adding a spath should be enough.

index=firemon sourcetype=firemon:rules | spath