Splunk Search

How to extract fields from JSON data and create a table using fields?

Kisame27
Explorer

2022-04-11 05:46:26 POST /BestMarket.Internal.Market.Transactions/MarketTransactionService

 ContractName="BestMarket.Platform.Transactions.Contracts.IProviderTransactionServiceAsync"+OperationName="WithdrawAsync"+RequestType="WithdrawRequest"+WithdrawRequest="{'ProviderName':'NIkora'+'BrandName':'Vazisubani'+'CustomerId':'2ed928f1-3bec-4794-adce-a3ed9221152b'+'Amount':0.6+'TransactionId':'6253c0b3eb303a42bed6ffc1'+Reference':'8382608392617'+'WalletmarketId':12946+'Comment':'market+round:+0cb0d4b0-13b1-41ff-b367-ad34446c717a:8382608392617'+'IsRepeatable':true+'IsFinal':false+'BonusContext':'best.Market'+'BonusContribution':0.0+'Device':1+'TransactionType':null+'DeviceType'

 

                 I want to  Get Amount As Table, but when i write   

|  table  Amount

-- Column is empty empty 

Labels (6)
0 Karma

tshah-splunk
Splunk Employee
Splunk Employee

Hey @Kisame27,

You can use spath to extract the json object attributes into separate fields. Then after, you will be able to visualize the Amount field in the table. Reference docs for spath command can be found here - https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Spath

---
If you find the answer helpful, an upvote/karma is appreciated
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...