Extract Json and Build a plot

[jitin_ratra]

I am looking to extract values from the Json to build out data to see what was the quote number that threw error. I am looking to build something like below. below is my Json

Region | Country | CustomerSet | Quote Number
EMEA | ZA | RC1390756 | 12729883

Message=Message :{
"Application": "checkoutro",
"UserAgent": "Mozilla/5.0",
"RouteTemplate": "api/{c}/{l}/{cs}/v3quote/addquotetoprofile/{quoteNumber}",
"RequestMethod": "POST",
"ControllerName": "V3Quote",
"ActionName": "AddQuoteToProfile",
"ActionArguments": {
"quoteNumber": 12729883,
"version": 1,
"source": 5,
"customerNumber": null
},
"ActionReturnTypeFullName": "System.Web.Http.IHttpActionResult",
"SessionId": "abc",
"LightweightProfile": {
"AccessGroup": "307b7c3e-e1a7-4366-9ed1-a77100b5973c",
"AccessGroupType": 0,
"ContentSegment": "bsd",
"Country": "ZA",
"CurrencyCode": "zar",
"CurrencyCultureInfo": null,
"CustomerSet": "RC1390756",
"DisplayCultureInfo": null,
"Language": "en",
"ProfileId": "f2fa479b-3224-4d42-83ba-520e7416d6ee",
"Region": "EMEA",
"SalesSegment": "CHN",
"SessionId": "abc",
"LocalizedCatalogId": 148,
"PricingTemplateId": 0,
"IsGlobalPortal": false,
"IsSiebelEnabledUsFedStore": false
}

Any help will be appreciatd here .

[kamlesh_vaghela]

@jitin_ratra

Can you please try this?

YOUR_SEARCH  | rex field=_raw "Message=Message :(?<json>.*)$" | eval _raw=json | kv | table LightweightProfile.Region LightweightProfile.Country LightweightProfile.CustomerSet ActionArguments.quoteNumber | rename "LightweightProfile.Region" as Region "LightweightProfile.Country" as Country "LightweightProfile.CustomerSet" as CustomerSet "ActionArguments.quoteNumber" as quoteNumber

My Sample Search:

| makeresults | eval _raw="Message=Message :{\"Application\": \"checkoutro\",\"UserAgent\": \"Mozilla/5.0\",\"RouteTemplate\": \"api/{c}/{l}/{cs}/v3quote/addquotetoprofile/{quoteNumber}\",\"RequestMethod\": \"POST\",\"ControllerName\": \"V3Quote\",\"ActionName\": \"AddQuoteToProfile\",\"ActionArguments\": {\"quoteNumber\": 12729883,\"version\": 1,\"source\": 5,\"customerNumber\": null},\"ActionReturnTypeFullName\": \"System.Web.Http.IHttpActionResult\",\"SessionId\": \"abc\",\"LightweightProfile\": {\"AccessGroup\": \"307b7c3e-e1a7-4366-9ed1-a77100b5973c\",\"AccessGroupType\": 0,\"ContentSegment\": \"bsd\",\"Country\": \"ZA\",\"CurrencyCode\": \"zar\",\"CurrencyCultureInfo\": null,\"CustomerSet\": \"RC1390756\",\"DisplayCultureInfo\": null,\"Language\": \"en\",\"ProfileId\": \"f2fa479b-3224-4d42-83ba-520e7416d6ee\",\"Region\": \"EMEA\",\"SalesSegment\": \"CHN\",\"SessionId\": \"abc\",\"LocalizedCatalogId\": 148,\"PricingTemplateId\": 0,\"IsGlobalPortal\": false,\"IsSiebelEnabledUsFedStore\": false} " | rex field=_raw "Message=Message :(?<json>.*)$" | eval _raw=json | kv | table LightweightProfile.Region LightweightProfile.Country LightweightProfile.CustomerSet ActionArguments.quoteNumber | rename "LightweightProfile.Region" as Region "LightweightProfile.Country" as Country "LightweightProfile.CustomerSet" as CustomerSet "ActionArguments.quoteNumber" as quoteNumber

Thanks