Help in field extraction

[badari]

Hello,

Sorry for a newbie question, I have the following event thats generated

{
@timestamp: 2021-06-03T17:39:34.720+00:00
@version: 1
correlation: test12345
message:{"code":200,"data":{"status":"status1234"}}
}

What query should I use to extract status, my requirement is when I execute my query it should come in a tabular form as follows

status status1234

Thanks in advance.

[isoutamo]

You should use spath command

[badari]

Thanks, is it possible to give me the sample spath command that I can use? Tried searching but not getting a proper answer.

[kamlesh_vaghela · Accepted solution]

@badari 

Can you please try this?

YOUR_SEARCH |spath message.data.status | rename message.data.* as * | table status | transpose

My Sample Search :

| makeresults | eval _raw="{\"@timestamp\": \"2021-06-03T17:39:34.720+00:00\",\"@version\": \"1\", \"correlation\": \"test12345\",\"message\":{\"code\":200,\"data\":{\"status\":\"status1234\"}}}"|spath message.data.status | rename message.data.* as * | table status | transpose

 

 Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.