JSON extraction needed

[mbasharat]

Hi. I have below raw event/s.

Highlighted Syntax:
{ [-]
   body: {"isolation": "isolation","device_classification": "Network Access Control","ip": "1.2.3.4", "mac": "Unknown","dns_hn": "XYZ","policy": "TEST_BLOCK","network_fn": "CounterACT Device","os_fingerprint": "CounterACT Appliance","nic_vendor": "Unknown Vendor","ipv6": "Unknown",}
   ctupdate: notif
   eventTimestamp: 1739913406
   ip: 1.2.3.4
   tenant_id: CounterACT__sample
}

Raw Text:
{"tenant_id":"CounterACT__sample","body":"{\"isolation\": \"isolation\",\"device_classification\": \"Network Access Control\",\"ip\": \"1.2.3.4\", \"mac\": \"Unknown\",\"dns_hn\": \"XYZ\",\"policy\": \"TEST_BLOCK\",\"network_fn\": \"CounterACT Device\",\"os_fingerprint\": \"CounterACT Appliance\",\"nic_vendor\": \"Unknown Vendor\",\"ipv6\": \"Unknown\",}","ctupdate":"notif","ip":"1.2.3.4","eventTimestamp":"1739913406"}

I need below fields=value extracted from each event at search time. It is a very small dataset:

isolation=isolation
policy=TEST_BLOCK
ctupdate=notif
ip=1.2.3.4
ipv6=Unknown
mac=Unknown
dns_hn=XYZ
eventTimestamp=1739913406

Thank you in advance!!!

[mbasharat]

Thank you @livehybrid !!!!! I knew I was dosing off at the end of the day.... LOL

[livehybrid · Accepted solution]

Hi @mbasharat 

Add "| spath input=body" to your SPL - this will then extract the fields within the body JSON key as keyval fields in your results.

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will