How to extract json value fields?

[karthi2809]

"reqUser":"mhundi","evtTime":"2023-06-08 14:04:06.504","access":"SELECT","resource":"dsc60180_ici_sde_tz_db/vehicle_master/light_truck_lob_flag,lincoln_lob_flag,model_e_lob_flag,vehicle_make_desc,vehicle_type_desc,warranty_start_date,vehicle_type_desc,warranty_start_date","resType":"@column","action":"select","result":1,"agent":"hiveServer2","policy":101343,"enforcer":"ranger-acl","sess":"00ef27f9-75a4-4821-9e8a-60f16af6b962","cliType":"HIVESERVER2","cliIP":"19.51.78.185","reqData":"SELECT * FROM (SELECT `Left`.`advisor_name`, `Left`.`appointment_created_by`, `Left`.`appointment_datetime

Fields to be extract 

reqUser, evtTime, resource

[isoutamo]

Hi

this is not a json data. It could be part of if but not really full, working json.

If you have full json, it should be usable without any difficulties e.g. with spath if/when onboarding has done correctly.

If it's not working json then you must use e.g. rex command to get wanted values from _raw event.

| rex "\"reqUser\":\"(?<reqUser>[^\"]+)\",\"evtTime\":\"(?<evtTime>[^\"]+)\","
| rex "\"resource\":\"(?<resource>[^\"]+)\""
| table reqUser evtTime resource 

r. Ismo