Splunk Search

How can I extract all fields and values from a json result?

efrenette11
Path Finder

Here's an example of the result that I have and I want to extract all fields. I know spath, but I don't want to name all fields.

source="/app/local/springboot/logs/payload/jms/jms-payload.log"| rex "topic://VirtualTopic.event: (?<payloads>.*)..logger=*" | table payloads

Tks.

{"common":{"id":{"tmclassic-us":{"id":"14004EF77FBE0C65"}},"name":{"es-us":"La Subasta","en-au":"La Subasta","es-mx":"La Subasta","fr-ca":"La Subasta","en-nz":"La Subasta","en-ca":"La Subasta","en-us":"La Subasta","en-mx":"La Subasta"},"publicVisibility":{"startDateTime":"1997-03-26T06:00:00.000Z","dateTBD":false},"isTest":false},"dates":{"start":{"localDate":"2015-08-15","localTime":"20:00:00","dateTime":"2015-08-16T01:00:00.000Z","dateTBD":false,"dateTBA":false,"timeTBA":false,"noSpecificTime":false},"timezone":"America/Mexico_City","displayOptions":{"displayMultipleDates":false},"scheduleChange":{}},"venue":{"id":{"tmonline-us":{"id":"164127"}}},"classification":{"browseCategory":{"major":{"id":{"tmonline-us":{"id":"10002"}}},"minor":{"id":{"tmonline-us":{"id":"32"}}}}},"sales":{"public":{"startTBD":true,"endDateTime":"2015-08-15T23:00:00.000Z"}}}
0 Karma
1 Solution

efrenette11
Path Finder

| spath input=payloads

I've found the solution. Tks to me

View solution in original post

efrenette11
Path Finder

| spath input=payloads

I've found the solution. Tks to me

Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...