How to break JSON for individual values

[msrama5]

Hello, I want to break the TestTransaction inside testVal values, JSON needs to break up and show all field values inside JSON, how can this search be rewritten?

Splunk search:

index=* sourcetype=WORKER | fields TestVal

TestVal values:

{"@t":"2020-02-04T22:16:20.8458700Z","@mt":"{@parameters}","parameters":{"info":"Published","message":{"TestTransaction":{"sampleval":"10298684736384305384235533777352","EntryType":141,"CheckNumber":783562,"CheckCloseDate":"2020-02-04T22:16:08.0000000Z","CurrencyCode":"USD","Tenders":[{"Amount":5.3,"Description":"SBUX Card","TenderId":"SV5j8AtfYVm","SvcVal":6147524390259141,"CurrencyCode":null,"$type":"TestTender"}],"TotalAmount":5.3,"SubtotalAmount":4.95,"TaxAmount":0.35,"DiscountAmount":0.0,"Header":{"ServiceType":null,"Number":22,"PosRequestDate":"2020-02-04T22:16:08.0000000Z","$type":"TestHeader"},"Preparation":"ConsumeOutOfStore","TestDetails":{"Discounts":[],"Items":[{"Qty":1.0,"Sku":null,"Price":4.95,"Discounts":[],"Description":null,"Price":null,"Suffix":null,"ChildItems":[],"Commerce":{"Sku":"11105767","edSku":null,"PosStatus":null,"Value":null,"$type":"Commerce"},"Product":{"ProductTypeId":11,"ProductType":"Beverage","ProductNumber":2123078,"FormCode":"salty","SizeCode":"test","LocalDescription":"test","$type":"Product"},"IsRefunded":false,"IsTaxed":false,"Summary":{"TotalPrice":4.95,"DiscountAmount":0,"SubtotalAmount":4.95,"$type":"TestItemSummary"},"$type":"TestItem"}],"Taxes":[{"Name":"State+Local Meals Tax 7%","Amount":35,"$type":"TestTax"}],"ReceiptLines":[],"Delivery":null,"$type":"TestDetails"},"$type":"TestTransaction"},"RequestId":"pos-200204141619-prodrh50592773796","MessageId":"BTxnApi_MID_b6cea268-af3c-4334-85df-c34108e81705","$type":"UpsertTestTransaction"}}}

[to4kawa · Accepted solution]

 index=* sourcetype=WORKER
| fields TestVal
| spath input=TestVal
| fields - TestVal

[msrama5]

Thanks everyone for answering, above query is working

[vnravikumar]

Hi

Check this

| makeresults 
| eval TestVal="{ 
   \"@t\":\"2020-02-04T22:16:20.8458700Z\",
   \"@mt\":\"{@parameters}\",
   \"parameters\":{ 
      \"info\":\"Published\",
      \"message\":{ 
         \"TestTransaction\":{ 
            \"sampleval\":\"10298684736384305384235533777352\",
            \"EntryType\":141,
            \"CheckNumber\":783562,
            \"CheckCloseDate\":\"2020-02-04T22:16:08.0000000Z\",
            \"CurrencyCode\":\"USD\",
            \"Tenders\":[ 
               { 
                  \"Amount\":5.3,
                  \"Description\":\"SBUX Card\",
                  \"TenderId\":\"SV5j8AtfYVm\",
                  \"SvcVal\":6147524390259141,
                  \"CurrencyCode\":null,
                  \"$type\":\"TestTender\"
                       }
            ],
            \"TotalAmount\":5.3,
            \"SubtotalAmount\":4.95,
            \"TaxAmount\":0.35,
            \"DiscountAmount\":0.0,
            \"Header\":{ 
               \"ServiceType\":null,
               \"Number\":22,
               \"PosRequestDate\":\"2020-02-04T22:16:08.0000000Z\",
               \"$type\":\"TestHeader\"
                    },
            \"Preparation\":\"ConsumeOutOfStore\",
            \"TestDetails\":{ 
               \"Discounts\":[ 

               ],
               \"Items\":[ 
                  { 
                     \"Qty\":1.0,
                     \"Sku\":null,
                     \"Price\":4.95,
                     \"Discounts\":[ 

                     ],
                     \"Description\":null,
                     \"Price\":null,
                     \"Suffix\":null,
                     \"ChildItems\":[ 

                     ],
                     \"Commerce\":{ 
                        \"Sku\":\"11105767\",
                        \"edSku\":null,
                        \"PosStatus\":null,
                        \"Value\":null,
                        \"$type\":\"Commerce\"
                             },
                     \"Product\":{ 
                        \"ProductTypeId\":11,
                        \"ProductType\":\"Beverage\",
                        \"ProductNumber\":2123078,
                        \"FormCode\":\"salty\",
                        \"SizeCode\":\"test\",
                        \"LocalDescription\":\"test\",
                        \"$type\":\"Product\"
                             },
                     \"IsRefunded\":false,
                     \"IsTaxed\":false,
                     \"Summary\":{ 
                        \"TotalPrice\":4.95,
                        \"DiscountAmount\":0,
                        \"SubtotalAmount\":4.95,
                        \"$type\":\"TestItemSummary\"
                             },
                     \"$type\":\"TestItem\"
                          }
               ],
               \"Taxes\":[ 
                  { 
                     \"Name\":\"State+Local Meals Tax 7%\",
                     \"Amount\":35,
                     \"$type\":\"TestTax\"
                          }
               ],
               \"ReceiptLines\":[ 

               ],
               \"Delivery\":null,
               \"$type\":\"TestDetails\"
                    },
            \"$type\":\"TestTransaction\"
                 },
         \"RequestId\":\"pos-200204141619-prodrh50592773796\",
         \"MessageId\":\"BTxnApi_MID_b6cea268-af3c-4334-85df-c34108e81705\",
         \"$type\":\"UpsertTestTransaction\"
              }
   }
}" 
| spath input=TestVal path=parameters.message.TestTransaction output=TestTransaction 
| spath input=TestTransaction