Splunk Search

How to extract fields from JSON data and create a table using fields?

Kisame27
Explorer

2022-04-11 05:46:26 POST /BestMarket.Internal.Market.Transactions/MarketTransactionService

 ContractName="BestMarket.Platform.Transactions.Contracts.IProviderTransactionServiceAsync"+OperationName="WithdrawAsync"+RequestType="WithdrawRequest"+WithdrawRequest="{'ProviderName':'NIkora'+'BrandName':'Vazisubani'+'CustomerId':'2ed928f1-3bec-4794-adce-a3ed9221152b'+'Amount':0.6+'TransactionId':'6253c0b3eb303a42bed6ffc1'+Reference':'8382608392617'+'WalletmarketId':12946+'Comment':'market+round:+0cb0d4b0-13b1-41ff-b367-ad34446c717a:8382608392617'+'IsRepeatable':true+'IsFinal':false+'BonusContext':'best.Market'+'BonusContribution':0.0+'Device':1+'TransactionType':null+'DeviceType'

 

                 I want to  Get Amount As Table, but when i write   

|  table  Amount

-- Column is empty empty 

Labels (6)
0 Karma

tshah-splunk
Splunk Employee
Splunk Employee

Hey @Kisame27,

You can use spath to extract the json object attributes into separate fields. Then after, you will be able to visualize the Amount field in the table. Reference docs for spath command can be found here - https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Spath

---
If you find the answer helpful, an upvote/karma is appreciated
0 Karma
Get Updates on the Splunk Community!

Extending Splunk AI Assistant for SPL to Splunk Enterprise customers!

Howdy Splunk Community! It’s an exciting day here at Splunk – Splunk AI Assistant for SPL version 1.3.0 is now ...

Developer Spotlight with Qmulos

Qmulos: Building a Next-Level Cybersecurity Business through Splunk Apps Qmulos started as a scrappy startup ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...