How do I extract a value from the the following JSON?

[abhishekgandhe]

I want to extract the following values from below JSON. Values needs to be extracted from the highlighted text in Bold.

model-cps-kkru-qa2 , Data Reconciliation, Honeywell.PMT.UOP.CPS.UniSimTaskService.exe. 

{"message":[{"raw":"06/12/18 05:37:47 [19] INFO  :: TenantId = model-cps-kkru-qa2 :: JobId = 85db2e7e-8b6a-4482-9d0f-40d7c48c7aa1 :: CalcType = Data Reconciliation :: UniSimInvokerServices.UniSimApplicationServices : UniSim Job Run completed successfully!","severityLevel":"Informational","className":"Honeywell.PMT.UOP.CPS.UniSimTaskService.UniSimEventProcessorHost+d__23","methodName":"MoveNext","lineNumber":389,"domain":"Honeywell.PMT.UOP.CPS.UniSimTaskService.exe","loggerName":"UTELogger","threadName":"19"}],"internal":{"data":{"id":"1d75acfe-f919-11e8-b912-eb327d060bc3","documentVersion":"1.61"}},"context":{"data":{"eventTime":"2018-12-06T05:37:47.8836038Z","isSynthetic":false,"samplingRate":100.0},"cloud":{},"device":{"type":"PC","roleInstance":"usd-qa-wk2-eus","screenResolution":{}},"session":{"isFirst":false},"operation":{},"location":{"clientip":"0.0.0.0","continent":"North America","country":"United States","province":"Virginia","city":"Boydton"},"custom":{"dimensions":[{**"TenantId":"model-cps-kkru-qa2"**},{"LoggerName":"UTELogger"},{**"CalcType":"Data Reconciliation"**},{"JobId":"85db2e7e-8b6a-4482-9d0f-40d7c48c7aa1"},{"MethodName":"MoveNext"},{"LineNumber":"389"},{**"Domain":"Honeywell.PMT.UOP.CPS.UniSimTaskService.exe"**},{"ThreadName":"19"},{"ClassName":"Honeywell.PMT.UOP.CPS.UniSimTaskService.UniSimEventProcessorHost+d__23"},{"FileName":"C:\\Users\\E542204\\Source\\Repos\\cps-unisim-taskexecutor\\Honeywell.PMT.UOP.CPS.UniSimTaskExecutor\\UniSimEventProcessorHost.cs"}]}}}

[jpolvino]

If you want to get just those 3, you can do this inline:

| eval TenantId=spath(json,"context.custom.dimensions.[TenantId]")
| eval CalcType=spath(json,"context.custom.dimensions.[CalcType]")
| eval Domain=spath(json,"context.custom.dimensions.[Domain]")

Not 100% sure about the brackets though.

[harsmarvania57]

Hi,

As this is full JSON event, you can index this data with below configuration on Universal Forwarder and splunk will automatically extract all fields present in JSON data.

props.conf

[yoursourcetype]
INDEXED_EXTRACTIONS = JSON

If you want to extract event at Search time you can use below query.

<yourBaseSearch> | spath

This will extract data in fields context.custom.dimensions{}.TenantId, context.custom.dimensions{}.CalcType and
context.custom.dimensions{}.Domain