Hello, I want to break the TestTransaction inside testVal values, JSON needs to break up and show all field values inside JSON, how can this search be rewritten?
Splunk search:
index=* sourcetype=WORKER | fields TestVal
TestVal values:
{"@t":"2020-02-04T22:16:20.8458700Z","@mt":"{@parameters}","parameters":{"info":"Published","message":{"TestTransaction":{"sampleval":"10298684736384305384235533777352","EntryType":141,"CheckNumber":783562,"CheckCloseDate":"2020-02-04T22:16:08.0000000Z","CurrencyCode":"USD","Tenders":[{"Amount":5.3,"Description":"SBUX Card","TenderId":"SV5j8AtfYVm","SvcVal":6147524390259141,"CurrencyCode":null,"$type":"TestTender"}],"TotalAmount":5.3,"SubtotalAmount":4.95,"TaxAmount":0.35,"DiscountAmount":0.0,"Header":{"ServiceType":null,"Number":22,"PosRequestDate":"2020-02-04T22:16:08.0000000Z","$type":"TestHeader"},"Preparation":"ConsumeOutOfStore","TestDetails":{"Discounts":[],"Items":[{"Qty":1.0,"Sku":null,"Price":4.95,"Discounts":[],"Description":null,"Price":null,"Suffix":null,"ChildItems":[],"Commerce":{"Sku":"11105767","edSku":null,"PosStatus":null,"Value":null,"$type":"Commerce"},"Product":{"ProductTypeId":11,"ProductType":"Beverage","ProductNumber":2123078,"FormCode":"salty","SizeCode":"test","LocalDescription":"test","$type":"Product"},"IsRefunded":false,"IsTaxed":false,"Summary":{"TotalPrice":4.95,"DiscountAmount":0,"SubtotalAmount":4.95,"$type":"TestItemSummary"},"$type":"TestItem"}],"Taxes":[{"Name":"State+Local Meals Tax 7%","Amount":35,"$type":"TestTax"}],"ReceiptLines":[],"Delivery":null,"$type":"TestDetails"},"$type":"TestTransaction"},"RequestId":"pos-200204141619-prodrh50592773796","MessageId":"BTxnApi_MID_b6cea268-af3c-4334-85df-c34108e81705","$type":"UpsertTestTransaction"}}}
index=* sourcetype=WORKER
| fields TestVal
| spath input=TestVal
| fields - TestVal
index=* sourcetype=WORKER
| fields TestVal
| spath input=TestVal
| fields - TestVal
Thanks everyone for answering, above query is working
Hi
Check this
| makeresults
| eval TestVal="{
\"@t\":\"2020-02-04T22:16:20.8458700Z\",
\"@mt\":\"{@parameters}\",
\"parameters\":{
\"info\":\"Published\",
\"message\":{
\"TestTransaction\":{
\"sampleval\":\"10298684736384305384235533777352\",
\"EntryType\":141,
\"CheckNumber\":783562,
\"CheckCloseDate\":\"2020-02-04T22:16:08.0000000Z\",
\"CurrencyCode\":\"USD\",
\"Tenders\":[
{
\"Amount\":5.3,
\"Description\":\"SBUX Card\",
\"TenderId\":\"SV5j8AtfYVm\",
\"SvcVal\":6147524390259141,
\"CurrencyCode\":null,
\"$type\":\"TestTender\"
}
],
\"TotalAmount\":5.3,
\"SubtotalAmount\":4.95,
\"TaxAmount\":0.35,
\"DiscountAmount\":0.0,
\"Header\":{
\"ServiceType\":null,
\"Number\":22,
\"PosRequestDate\":\"2020-02-04T22:16:08.0000000Z\",
\"$type\":\"TestHeader\"
},
\"Preparation\":\"ConsumeOutOfStore\",
\"TestDetails\":{
\"Discounts\":[
],
\"Items\":[
{
\"Qty\":1.0,
\"Sku\":null,
\"Price\":4.95,
\"Discounts\":[
],
\"Description\":null,
\"Price\":null,
\"Suffix\":null,
\"ChildItems\":[
],
\"Commerce\":{
\"Sku\":\"11105767\",
\"edSku\":null,
\"PosStatus\":null,
\"Value\":null,
\"$type\":\"Commerce\"
},
\"Product\":{
\"ProductTypeId\":11,
\"ProductType\":\"Beverage\",
\"ProductNumber\":2123078,
\"FormCode\":\"salty\",
\"SizeCode\":\"test\",
\"LocalDescription\":\"test\",
\"$type\":\"Product\"
},
\"IsRefunded\":false,
\"IsTaxed\":false,
\"Summary\":{
\"TotalPrice\":4.95,
\"DiscountAmount\":0,
\"SubtotalAmount\":4.95,
\"$type\":\"TestItemSummary\"
},
\"$type\":\"TestItem\"
}
],
\"Taxes\":[
{
\"Name\":\"State+Local Meals Tax 7%\",
\"Amount\":35,
\"$type\":\"TestTax\"
}
],
\"ReceiptLines\":[
],
\"Delivery\":null,
\"$type\":\"TestDetails\"
},
\"$type\":\"TestTransaction\"
},
\"RequestId\":\"pos-200204141619-prodrh50592773796\",
\"MessageId\":\"BTxnApi_MID_b6cea268-af3c-4334-85df-c34108e81705\",
\"$type\":\"UpsertTestTransaction\"
}
}
}"
| spath input=TestVal path=parameters.message.TestTransaction output=TestTransaction
| spath input=TestTransaction