Splunk Search

Need help with spath for json extraction

wheels531
Engager

I'm trying to use spath to extract fields from a json object in an event.

 

This is the event

2023-03-08T22:47:06.66452157Z app_name=assistedonboardi environment=e1 ns=assistedonboarding-intra pod_container=assistedonboardi pod_name=assistedonboardi-deployment-19-64w7w stream=stdout message={"schemaVersion":"0.3.0","application":{"name":"One App","version":"5.15.5-fec34698"},"device":{"gent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36"},"level":"error","timestamp":"2023-03-08T22:47:06.664Z","error":{"name":"ClientReportedError","message":"<none>","stacktrace":"<none>"},"request":{"address":{"uri":"https://test?authBlueCorrelationId=234dkfhdf&redirects=1"},"metaData":{"moduleID":"axp-global-onboarding-corporate-application-capture-us","opportunityId":"testid","companyName":"","cdacApplicationStatus":"","marketIso2":"US","correlationId":"a17a9feb-eb54-40ae-951e-f6648e02ab88"}}}


message contains the json object and I want for example to extract the opportunityId so I'm trying this.

ns=assistedonboarding-intra AND axp-global-onboarding-corporate-application-capture-us | fields message | spath output=opportunityId path=message.request.metaData.opportunityId


But nothing actually happens. Any help would be appreciated.

 

 

Labels (1)
0 Karma
1 Solution

wheels531
Engager

Solved on my own. I forgot to specify input=message. 🙂

View solution in original post

0 Karma

wheels531
Engager

Solved on my own. I forgot to specify input=message. 🙂

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...