How do I get Splunk to recognize and parse one of my field values in JSON format?

[brent_weaver]

I have perfect key/value pairs in my log (I am using the Splunk Add-on for Microsoft Azure to get table storage logs). The logs have:

LogTyppe:    LogTyppe   
MessageDetail:   {"test"="this will work", "name"="value", "name1"="value1", "name2"="value2"}
MessageSummary:  MessageSummary 
NetworkAddress:  NetworkAddress 

Notice in MessageDetail there is a JSON formatted string... How do I get Splunk to recognize that one of the field values as json format?

[Masa]

Hi, @ brent_weaver, please update the title and question and avoid saying the event is json. Otherwise, people misunderstand this question itself.

[Masa]

 {"test"="this will work", "name"="value", "name1"="value1", "name2"="value2"}

This is not json format???

Assuming you have json format value for MessageDetail field,

 <your search> | spath input=MessageDetail

[gjanders]

http://json.org/example.html is an example of what JSON data actually looks like, the above is key=value which is not JSON...

[jkat54]

using spath in verbose mode?

[brent_weaver]

THANK YOU for the answer. Let me ask a little bit differently, how do I get this field to be treated as interesting fields?

[Masa]

Sorry but I do not understand your question.
Also, instead of creating a new answer, can you add comment to an existing answer or, update your question as more elaborated question?

[Masa]

I'm still trying to understand your question especially your word "this field" above. Maybe it is because I do not understand Azure event contents.

Assuming you want to have Key-Value field extraction for any format of "key"="value" string, you can achieve it in transforms.conf and props.conf.
Note: I'm assuming sourcetype is azure_test in this example.

- props.conf
[azure_test]
REPORT-extract_kv = extact_kv

- transforms.conf
[extract_kv]
REGEX = "(?<_KEY_1>[^\"]+)"="(?<_VAL_1>[^\"]+)"

Of course using this idea, you can do more specific for only for certain field value, etc.