Splunk Search

Json field extract

priyangshupal
Engager

I have a json like this:

 

{
  "A": [
    {
      "B": [
        {
          "status": "2",
          "value": "1"
        },
        {
          "status": "1",
          "value": "2"
        },
        {
          "status": "3",
          "value": "4"
        },
        {
          "status": "5",
          "value": "8"
        }
      ]
    }
  ]
}

 

I want to extract the field  value.

I tried doing

 

spath input=field_name output=value path=A{0}.B{}.value

 

but it's not working

Pls help

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Works for me.

| makeresults 
| eval json="{
\"A\": [
{
\"B\": [
{
\"status\": \"2\",
\"value\": \"1\"
},
{
\"status\": \"1\",
\"value\": \"2\"
},
{
\"status\": \"3\",
\"value\": \"4\"
},
{
\"status\": \"5\",
\"value\": \"8\"
}
]
}
]
}"
| spath input=json path="A{}.B{}.value" output=vals

You forgot to put the path in quotes.

0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...