Splunk Search

Need help with spath for json extraction

wheels531
Engager

I'm trying to use spath to extract fields from a json object in an event.

 

This is the event

2023-03-08T22:47:06.66452157Z app_name=assistedonboardi environment=e1 ns=assistedonboarding-intra pod_container=assistedonboardi pod_name=assistedonboardi-deployment-19-64w7w stream=stdout message={"schemaVersion":"0.3.0","application":{"name":"One App","version":"5.15.5-fec34698"},"device":{"gent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36"},"level":"error","timestamp":"2023-03-08T22:47:06.664Z","error":{"name":"ClientReportedError","message":"<none>","stacktrace":"<none>"},"request":{"address":{"uri":"https://test?authBlueCorrelationId=234dkfhdf&redirects=1"},"metaData":{"moduleID":"axp-global-onboarding-corporate-application-capture-us","opportunityId":"testid","companyName":"","cdacApplicationStatus":"","marketIso2":"US","correlationId":"a17a9feb-eb54-40ae-951e-f6648e02ab88"}}}


message contains the json object and I want for example to extract the opportunityId so I'm trying this.

ns=assistedonboarding-intra AND axp-global-onboarding-corporate-application-capture-us | fields message | spath output=opportunityId path=message.request.metaData.opportunityId


But nothing actually happens. Any help would be appreciated.

 

 

Labels (1)
0 Karma
1 Solution

wheels531
Engager

Solved on my own. I forgot to specify input=message. 🙂

View solution in original post

0 Karma

wheels531
Engager

Solved on my own. I forgot to specify input=message. 🙂

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Management Digest – August 2026

MichelleCorpora_1-1788182384472.png Welcome to the August 2026 edition of Data Management Digest! August was a ...

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...