Extract value from json in props.conf

[Poojitha]

Hi All,

I want to extract email  from json event in splunk.

Query I am using is :

index=*sec sourcetype=test
| eval tags_json=spath(_raw, "Tag{}"), final_tag_json=json_object()
| foreach mode=multivalue tags_json [ | eval final_tag_json=json_set(final_tag_json, spath('<<ITEM>>', "Key"), spath('<<ITEM>>', "Value"))]
| spath input=final_tag_json
| rex field=Email "(?<email>^\w+@abc.com$)"

Raw data :

"Tag": [{"Key": "app", "Value": “test”_value}, {"Key": "key1", "Value": "value1"}, {"Key": "key2", "Value": "value2"},  {"Key": “email”, "Value": “test@abc.com}],

I want email to be mapped to contact when indexed. How can I achieve this ? Please help me

Regards,
pnv

[KendallW]

Hi @Poojitha following the example from the documentation on spath: https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Spath#3:_Extract_and_expand_JSON_... 

Here is a runanywhere example:

| makeresults
| eval _raw="{
\"Tag\": [
    {\"Key\": \"app\", \"Value\": \"test_value\"}, 
    {\"Key\": \"key1\", \"Value\": \"value1\"}, 
    {\"Key\": \"key2\", \"Value\": \"value2\"},  
    {\"Key\": \"email\", \"Value\": \"test@abc.com\"},
  ]
}
"
| spath
| rename Tag{}.Key as key, Tag{}.Value as value
| eval x=mvzip(key,value)
| mvexpand x
| eval x=split(x,",")
| eval key=mvindex(x,0)
| eval value=mvindex(x,1)
| table _time key value