Splunk searching according to a value of a JSON field

[Matan1986]

Hi Guys,

I have a stream of JSONs and I want to search for the JSONs which name field is John. It's just like writing WHERE name="John" in SQL.
I tried to use spath command without success. I wrote:

source="tcp:8601" sourcetype="_json" | spath path=name output="John"

What would you advise me to do?

[woodcock]

The spath command creates the fields. If you already have KV_MODE=JSON set for this sourcetype, this command should not be necessary. In any case, it does not filter so you have to use search or where for that after the fields are created, maybe like this:

 source="tcp:8601" sourcetype="_json" | spath | search name="John"

Or maybe just:

 source="tcp:8601" sourcetype="_json"| search name="John"