How to extract Json object as field?

[karthi2809]

Hi ,

How to extract the fields from below json logs.

Here we have fields like content.jobname and content.region .But i need to extract  content.payload details.how to extract the value.

"content" : {
    "jobName" : "PAY",
    "region" : "NZ",
    "payload" : [ {
      "Aresults" : [ {
        "count" : "6",
        "errorMessage" : null,
        "filename" : "9550044.csv"
      } ]
    }, {
      "Bresults" : [ {
        "count" : "6",
        "errorMessage" : null,
        "filename" : "9550044.csv"
      } ]
    } ]
  }

[isoutamo]

Hi 

As @richgalloway said, have you look command spath?

There are quite many old answers where are asked quite similar questions. Just use google/bing or what ever to find those.

• https://community.splunk.com/t5/Getting-Data-In/How-to-handle-simple-JSON-array-with-spath/m-p/10317...
• https://community.splunk.com/t5/Splunk-Search/How-to-parse-my-JSON-data-with-spath-and-table-the-dat...

r. Ismo

[richgalloway]

What have you tried so far?  Did you try the spath command?

[karthi2809]

Yes i tried but in my case need to extract whole content.payload as one field.

[richgalloway]

The first step is to make sure the data is valid JSON because the spath command will not work with invalid JSON.  jsonlint.com rejected the sample object.

Here is a run-anywhere example that extracts payload as a single field.

| makeresults format=json data="[{\"content\" : {
    \"jobName\" : \"PAY\",
    \"region\" : \"NZ\",
    \"payload\" : [ {
      \"Aresults\" : [ {
        \"count\" : \"6\",
        \"errorMessage\" : null,
        \"filename\" : \"9550044.csv\"
      } ]
    }, {
      \"Bresults\" : [ {
        \"count\" : \"6\",
        \"errorMessage\" : null,
        \"filename\" : \"9550044.csv\"
      } ]
    } ]
  }}
  ]"
| spath output=payload content.payload{}