Splunk Search

Need help with spath for json extraction

wheels531
Engager

I'm trying to use spath to extract fields from a json object in an event.

 

This is the event

2023-03-08T22:47:06.66452157Z app_name=assistedonboardi environment=e1 ns=assistedonboarding-intra pod_container=assistedonboardi pod_name=assistedonboardi-deployment-19-64w7w stream=stdout message={"schemaVersion":"0.3.0","application":{"name":"One App","version":"5.15.5-fec34698"},"device":{"gent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36"},"level":"error","timestamp":"2023-03-08T22:47:06.664Z","error":{"name":"ClientReportedError","message":"<none>","stacktrace":"<none>"},"request":{"address":{"uri":"https://test?authBlueCorrelationId=234dkfhdf&redirects=1"},"metaData":{"moduleID":"axp-global-onboarding-corporate-application-capture-us","opportunityId":"testid","companyName":"","cdacApplicationStatus":"","marketIso2":"US","correlationId":"a17a9feb-eb54-40ae-951e-f6648e02ab88"}}}


message contains the json object and I want for example to extract the opportunityId so I'm trying this.

ns=assistedonboarding-intra AND axp-global-onboarding-corporate-application-capture-us | fields message | spath output=opportunityId path=message.request.metaData.opportunityId


But nothing actually happens. Any help would be appreciated.

 

 

Labels (1)
0 Karma
1 Solution

wheels531
Engager

Solved on my own. I forgot to specify input=message. 🙂

View solution in original post

0 Karma

wheels531
Engager

Solved on my own. I forgot to specify input=message. 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 2)

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Index This | I am a number but I am countless. What am I?

January 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  Happy New Year! We’re ...

What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience

PLATFORM TECH TALKS What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience Thursday, February 27, ...