Hi All,
I am looking for a field extraction at that time at indexing for JSON file format.
{"field1": "a=\"1", b=\"\",c=\"\",d=\"4", "field2": "x=\"a",y=\"\", "field3": "value3",}
getting logs in Splunk as below
field1 =a="1", b="",c="",d="4"
field2=x="a",y=" "
But, Looking for key value pair for a,b,c,d,x,y in the form of fieldname and fieldvalue.
a=1
d=4
x=a
Tried with spath,xmlkv, but no luck.
Could you please help me out in this.
Thanks in advance
SED-alter=s/=\\"/:\\"/
its not working.
Could you please suggest any other way ?