What I want to do is display the content of the message.model. However when I attempt to do this with things as
MYSEARCH | spath output=myfield path="message.model" | table myfield
the output is not visualized as JSON (but as text with no spaces, indentation or linebreaks).
I want the same visualization as in the attached image, but ONLY the message.model.
How do I achieve this?
@mrg_linus, the above view is only available with visualization selected as Events
. Even in your screenshot you would notice a link to toggle the event view between Show syntax higlighted
and Show as raw text
. You can use the same in Event visualization but with your JSON subset as a new field.
Following is sample Simple XML with event
view. Replace your actual search to try out:
<row>
<panel>
<event>
<search>
<query>MYSEARCH
| spath output=myfield path="message.model"
| table myfield</query>
<earliest>0</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="list.drilldown">none</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">0</option>
<option name="table.drilldown">all</option>
<option name="table.sortDirection">asc</option>
<option name="table.wrap">1</option>
<option name="type">list</option>
</event>
</panel>
</row>
Poke. Find the result of your suggestion below.