Not able to use JSON fields in search

[sabari80]

This is my sample event

onlinequoteinguser 2023-01-11T10:27:13,843 INFO DigitalPortal.xxxeSubmissionUtil
{"hostName": "xxx80hlxxda044",
"SourceSystem": "null",
"level": "INFO",
"message": "Start | newSubmission",
"serverId": "prod-xxx_xx78",
"userId": "onlinequoteinguser",
"contextMap": [
{"JsonRpcId":"b55296cf-81e1-4xxx-8064-052dxx416725_5"},
{"methodName":"createOrUpdateDraftSubmission"},
{"traceabilityID":"7cxxx367-09aa-4367-87d4-b120526xxxcb"},
{"requestPath":"\/edge\/xxxquoteflow\/letsgetstarted"}],
"applicationName": "xx",
"timestamp": "20230111T102713.841-0500"}

here is my query to retrieve specific event based my my JSON field 

index=app_xx Appid="APP-xxxx" Environment=PROD "contextMap{}.methodName"="createOrUpdateDraftSubmission" 

How to make appropriate search?

[yuanliu · Accepted solution]

A job for spath.  But first, you need to separate the JSON object.

| eval eSubmission = replace(_raw, "onlinequoteinguser .*eSubmissionUtil", "")
| spath input=eSubmission
| fields - data eSubmission

Your sample data gives

sourceSystem	applicationName	contextMap{}.JsonRpcId	contextMap{}.methodName	contextMap{}.requestPath	contextMap{}.traceabilityID	hostName	level	message	serverId	timestamp	userId
null	xx	b55296cf-81e1-4xxx-8064-052dxx416725_5	createOrUpdateDraftSubmission	/edge/xxxquoteflow/letsgetstarted	7cxxx367-09aa-4367-87d4-b120526xxxcb	xxx80hlxxda044	INFO	Start | newSubmission	prod-xxx_xx78	20230111T102713.841-0500	onlinequoteinguser

Here is the emulation I used.  You can play with it and compare to real data.

| makeresults
| fields - _time
| eval data = "onlinequoteinguser 2023-01-11T10:27:13,843 INFO DigitalPortal.xxxeSubmissionUtil
{\"hostName\": \"xxx80hlxxda044\",
\"SourceSystem\": \"null\",
\"level\": \"INFO\",
\"message\": \"Start | newSubmission\",
\"serverId\": \"prod-xxx_xx78\",
\"userId\": \"onlinequoteinguser\",
\"contextMap\": [
{\"JsonRpcId\":\"b55296cf-81e1-4xxx-8064-052dxx416725_5\"},
{\"methodName\":\"createOrUpdateDraftSubmission\"},
{\"traceabilityID\":\"7cxxx367-09aa-4367-87d4-b120526xxxcb\"},
{\"requestPath\":\"\/edge\/xxxquoteflow\/letsgetstarted\"}],
\"applicationName\": \"xx\",
\"timestamp\": \"20230111T102713.841-0500\"}"
``` data emulation above ```

[richgalloway]

Please share the props.conf settings for that sourcetype.