Splunk Search

Need help with spath for json extraction

wheels531
Engager

I'm trying to use spath to extract fields from a json object in an event.

 

This is the event

2023-03-08T22:47:06.66452157Z app_name=assistedonboardi environment=e1 ns=assistedonboarding-intra pod_container=assistedonboardi pod_name=assistedonboardi-deployment-19-64w7w stream=stdout message={"schemaVersion":"0.3.0","application":{"name":"One App","version":"5.15.5-fec34698"},"device":{"gent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36"},"level":"error","timestamp":"2023-03-08T22:47:06.664Z","error":{"name":"ClientReportedError","message":"<none>","stacktrace":"<none>"},"request":{"address":{"uri":"https://test?authBlueCorrelationId=234dkfhdf&redirects=1"},"metaData":{"moduleID":"axp-global-onboarding-corporate-application-capture-us","opportunityId":"testid","companyName":"","cdacApplicationStatus":"","marketIso2":"US","correlationId":"a17a9feb-eb54-40ae-951e-f6648e02ab88"}}}


message contains the json object and I want for example to extract the opportunityId so I'm trying this.

ns=assistedonboarding-intra AND axp-global-onboarding-corporate-application-capture-us | fields message | spath output=opportunityId path=message.request.metaData.opportunityId


But nothing actually happens. Any help would be appreciated.

 

 

Labels (1)
0 Karma
1 Solution

wheels531
Engager

Solved on my own. I forgot to specify input=message. 🙂

View solution in original post

0 Karma

wheels531
Engager

Solved on my own. I forgot to specify input=message. 🙂

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...