How to extract value and type in a search?

[Srikanth1131]

payload: Message  { channel=EMAIL , type=security_event_postinfection_admin ,  locale=it_IT , recipientAddress=LIOUDMILA@ME.COM,  data=[MESSAGEDATA  {  key=domain,  value=https://okt.to/ , type=null } , MessageData  {  key=date_time ,  value=2022-03-24T22:22:48.809 ,  type=null }  MessageData  {  key=policy ,  value=botnet ,  type=null } ,  MessageData  {key=content_categories ,  value=[malware] ,  type=null } ,  MessageData  {  key=manfacturer ,  value=Intel ,  type=null } ]}

[ITWhisperer]

Is this the actual raw data, or it the real data proper JSON? For example, can you use spath to extract message data as a multi-value field, expand that, then extract the key, value and type from the message data?

[Srikanth1131]

Yes it is json format and we use spath. Can you please tell me how to extract it using spath

[ITWhisperer]

Can you share the raw event data in a code block?