Not able to parse json with spath ,something wrong but not json

[ekmek4]

Hi,

I need to ingest some logs into splunk, so file&dirs data input its my choice.

Also new index was created , _json as sourcetype. Now im trying to use spath in search to parse JSON data with multifields and no luck yet. Just checked my json file - valid json.

Here we have some parsed json, but i want to get email, first_name,last_name from properties.attributes to be able parse or filter by any of this fields in future

Appreciate any help.

Small source file:

https://paste2.org/OsEXkgbJ

Here is what i tried :

index=ep_log event=created | spath properties.attributes

index=erp_log event=created | spath properties and so on

[ekmek4 · Accepted solution]

index=ep_log event=created | spath path=properties | mvexpand properties | spath input=properties

This query automatically expand fields with every attribute key. 

[ITWhisperer]

Try something like this

| spath properties
| spath input=properties attributes

[ekmek4]

Now i have a new field "attributes"

attributes: 

 {"email": "gacilia@gmail.com", "clients": {"ERP Frontend": "GEgzvJrIJxxHNS9FVdSvUej5wyrBgd2sSHH7RLuE", "Frontend CRM": "ILrkYrSCSsKgdgxBRv0COxKLaOzKufXogzWEAoh8"}, "is_active": false, "last_name": "Gac", "legacy_id": "66f510fea8f5e1ff130f5fa0", "first_name": "Ilia", "start_date": null, "is_team_supervisor": true, "two_factor_auth_enabled": false}

[ITWhisperer]

Does this give you what you want?

| spath properties
| spath input=properties attributes
| spath input=attributes

[ekmek4]

| spath path=properties | mvexpand properties | spath input=properties

this works fine for me. Thank you!!