- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to extract fields from JSON data and create a table using fields?
2022-04-11 05:46:26 POST /BestMarket.Internal.Market.Transactions/MarketTransactionService
ContractName="BestMarket.Platform.Transactions.Contracts.IProviderTransactionServiceAsync"+OperationName="WithdrawAsync"+RequestType="WithdrawRequest"+WithdrawRequest="{'ProviderName':'NIkora'+'BrandName':'Vazisubani'+'CustomerId':'2ed928f1-3bec-4794-adce-a3ed9221152b'+'Amount':0.6+'TransactionId':'6253c0b3eb303a42bed6ffc1'+Reference':'8382608392617'+'WalletmarketId':12946+'Comment':'market+round:+0cb0d4b0-13b1-41ff-b367-ad34446c717a:8382608392617'+'IsRepeatable':true+'IsFinal':false+'BonusContext':'best.Market'+'BonusContribution':0.0+'Device':1+'TransactionType':null+'DeviceType'
I want to Get Amount As Table, but when i write
| table Amount
-- Column is empty empty
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hey @Kisame27,
You can use spath to extract the json object attributes into separate fields. Then after, you will be able to visualize the Amount field in the table. Reference docs for spath command can be found here - https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Spath
If you find the answer helpful, an upvote/karma is appreciated
