#Random
This is a place to discuss all things outside of Splunk, its products, and its use cases.

How do I extract key value from below Json Sample.

vreddy22
New Member

Hi All, I have a sample json event in Splunk as below.  Please help me to understand how I can parse custom_tags value from below . This may have multiple key value pairs in it

{

account:xyz,

eventdate:01/25/2024,

properties: {

            version:1.0,

             requestID: cvv,

              response: {"statusCode":"200", "result":"{\"run_id\":465253,\"custom_tags\":{\"jobname\":\"xyz\",\"domain\":\"bgg\"}}}

              time:12:55

}

}

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use spath for json data

| spath input=properties
| spath input=response.result custom_tags
| spath input=custom_tags
0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...