how to convert JSON property of event to string?

[Mayukh]

Hello,

I have a HEC with events like the following:

{
    "Log": {
        "Status": "Ordered",
        "Platform": {
            "A": {
                "Tracking": {"Field1": "Value1", "Field2": "Value2"}
            }
        }
    }
}

When I run the query

index="my_index" AND Log.Status="Ordered" 
| table Log.Status Log.Platform.A.Tracking

• I get all the data for Status.
• However my requirement is to have the JSON object Log.Platform.A.Tracking in a string format - the JSON as a String?

How can I achieve this?

[Mayukh]

Thank you so much!

[ITWhisperer · Accepted solution]

| spath path=Log.Status output=Status
| spath path=Log.Platform.A.Tracking output=Tracking
| table Status Tracking