The message you are trying to access is permanently deleted.
Assuming you have already extracted the data field, and that the string in data is valid JSON (which you example is not), you could try this
| spath input=data
| where 'response.action.type'="UserCreated" OR 'response.action.type'="TxCreated"
| eval id = coalesce('response.resources{}.id', 'response.actors.id')
Many thanks for the help. I want to expand the requirement as follows:
For an "id" there could be upto 12 max possible different events with response.action.type="UserCreated" or response.action.type="TxCreated" or response.action.type="TxUpdated" and 9 other types.
The goal is to group by "id" where only 2 action types have occured namely:
Assuming you have already extracted the data field, and that the string in data is valid JSON (which you example is not), you could try this
| spath input=data
| where 'response.action.type'="UserCreated" OR 'response.action.type'="TxCreated"
| eval id = coalesce('response.resources{}.id', 'response.actors.id')
| spath input=data
| foreach *.id
[| eval id=if(isnotnull('<<FIELD>>'),'<<FIELD>>',id)]
Alternatively, if you already have all possible paths and there are not too many, coalesce can be more succinct. For the two path illustrated,
| eval id = coalesce('response.resources.id', 'respones.actors.id')