How to extract values of a particular field for a json event.

[tsm0099]

I have an event which is in json and it has a repeating field say "message"

Example:

{

"Message":[

{

"message":"xyz987"

},

{

"message":"abc123"

},

{

"message":"abc456"

},

{

"message":"abc567"

},

]

}

I have to form a table with the values of message that only starts with abc(i.e abc123, abc456, abc567) and exclude the other values(i.e xyz987)

How may I achieve this?

Thanks in advance

[richgalloway]

| makeresults | eval _raw="{
\"Message\":[
{
\"message\":\"xyz987\"
},
{
\"message\":\"abc123\"
},
{
\"message\":\"abc456\"
},
{
\"message\":\"abc567\"
},
]
}" | spath | mvexpand "Message{}.message"
| where match('Message{}.message',"^abc.*")

[tsm0099]

How do i form a table with those values?