Splunk Search

How to extract json field values?

karthi2809
Builder

Hi All,

I have a field called content.payload and the value is like .How to extract these values
{fileName=ExchangeRates.csv, periodName=202403, status=SUCCESS, subject=, businessEventMessage=RequestID: 101524, GL Monthly Rates - Validate and upload program}

Labels (1)
0 Karma

deepakc
Builder

This is an example using makeresults command - you can use the rex command to extract key values from the  content.payload field 

Example only to show you how to extract some of fields I have called my field data replace this with yours .

| makeresults
| eval data = "fileName=ExchangeRates.csv, periodName=202403, status=SUCCESS, subject=, businessEventMessage=RequestID: 101524, GL Monthly Rates - Validate and upload program"
| rex field=data "fileName=(?<fileName>\w+\.\w+),\speriodName=(?<periodName>\w+),\sstatus=(?<status>\w+)"
| table *

Or look at the spath command  that may also be another way

Get Updates on the Splunk Community!

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...