Extract data from Jason

[ppanchal]

Hi,
I want to extract fields like date, site, etc from the below log (jason), how can I do this?

[{"date":"2018-01-30","site":"S01027","routePublishCount":"17","routeCount":"97","customerCount":"931"},{"date":"2018-01-30","site":"S02923","routePublishCount":"16","routeCount":"119","customerCount":"1248"},{"date":"2018-01-30","site":"S03175","routePublishCount":"14","routeCount":"79","customerCount":"701"},{"date":"2018-01-30","site":"S03422","routePublishCount":"24","routeCount":"146","customerCount":"1486"}]

[mayurr98]

hey try this run anywhere search

| makeresults 
| eval _raw="[{\"date\":\"2018-01-30\",\"site\":\"S01027\",\"routePublishCount\":\"17\",\"routeCount\":\"97\",\"customerCount\":\"931\"},{\"date\":\"2018-01-30\",\"site\":\"S02923\",\"routePublishCount\":\"16\",\"routeCount\":\"119\",\"customerCount\":\"1248\"},{\"date\":\"2018-01-30\",\"site\":\"S03175\",\"routePublishCount\":\"14\",\"routeCount\":\"79\",\"customerCount\":\"701\"},{\"date\":\"2018-01-30\",\"site\":\"S03422\",\"routePublishCount\":\"24\",\"routeCount\":\"146\",\"customerCount\":\"1486\"}]" 
| spath 
| rename {}.* as *

In your environment, you should try

index=<your_index> 
| spath 
| rename {}.* as * 
| table date site

let me know if this helps!

[anthonymelita]

Splunk can do some automatic handling of Json. After your initial search command, try piping either
| spath
or
| extract pairdelim="{,}" kvdelim=":"

[ppanchal]

can you give me a complete search query?

I am doing,
index=* | table date, site

[anthonymelita]

I didn't pay close attention to your example being a single event multivalue json, so not entirely sure this will work:

index=*
| extract pairdelim="{,}" kvdelim=":"
| table date, site

there are other commands for handling multivalue like mvexpand

[ppanchal]

Not sure why but the above query is returning only single value from the jason. Please help.

date site
2018-01-30 S01027