Splunk query- How to use spath command for the below logs?

[LogUx]

How to use spath command for the below logs i have attached in the screenshot.

 

[ITWhisperer]

| rex "Error log: (?<json>\{.*\})"
| spath input=json

[LogUx]

@ITWhisperer Thanks for your reply but it is Not working for me.

[ITWhisperer]

What are you getting in the json field?

[LogUx]

@ITWhisperer I have tried this and now it is working fine.

IMG_20220512_195036__01.jpg

[LogUx]

@ITWhisperer  I think rex is not properly working.

[ITWhisperer · Accepted solution]

Sorry, I forgot you need to deal with multiline values

| rex "(?ms)Error log: (?<json>\{.*\})"
| spath input=json