How can I search specific object value of json data in spunk?

[chaithanyaSplun]

How can I search for results where value of C is 987654321 and E is null from the below sample.

CLASS=Test MTD=getMethod LN=10 : METRICS_JSON_NODE=
"ABC": [
{
"A": "abc",
"B": "c1b1a1",
"C": 987654321,
"D": 123,
"E": 123456789,
"F": false,
"G": "bcfaff1d50025094089f5a02d0dbd00e568d7dbe"
}
]
}

[niketn]

@chaithanyaSplunk, try the following run anywhere search based on sample data provided. You need to put in your base search instead of first two pipes i.e. | makeresults and | eval _raw ..., which are used to generate mock data.

Your JSON Data needs to be extracted from _raw, which I have done using rex command and extracted jsonData. The jsonData is fed to spath command as input to extract all the fields. Finally where command is used to implement the filter you need.

|  makeresults
|  eval _raw="CLASS=Test MTD=getMethod LN=10 : METRICS_JSON_NODE=
\"ABC\": [
{
\"A\": \"abc\",
\"B\": \"c1b1a1\",
\"C\": 987654321,
\"D\": 123,
\"E\": 123456789,
\"F\": false,
\"G\": \"bcfaff1d50025094089f5a02d0dbd00e568d7dbe\"
}
]
}"
|  rex "(?ms)\"ABC\": \[(?<jsonData>[^\]]+\])"
|  spath input=jsonData
|  where C=987654321 AND isnotnull(E)

[niketn]

You can also try search command instead of final where pipe

 <YourBaseSearch>
|  rex "(?ms)\"ABC\": \[(?<jsonData>[^\]]+\])"
|  spath input=jsonData
| search C=987654321 AND E=*

[niketn]

@chaithanyaSplunk, can you please confirm whether this resolved your issue or not?