extracting nested json

[MichaelBs]

MichaelBs_1-1715008039869.pngMichaelBs_2-1715008356513.png

I am trying to extract the path as a field to do a lookup with it. I've tried but it doesn't work. I need help extracting that path. There are other paths in the data but need that particular path

[marnall]

Is your data being interpreted by Splunk as JSON? Try expanding the event fields and seeing if it automatically extracts the json fields. If not, you'll have to change the indexing of the event so it is read as a JSON object. Then you can use SPATH or the auto-extracted fields to get the desired values.

[MichaelBs]

Spath didn't give the right fields 

[youngso]

you have to search and index the json by branch and nodes.  If you need the SPL, let me know.

[MichaelBs]

I need the SPL

[MichaelBs]

@yuanliu