how to extract nested fields using search command

[disha]

Hi,
I have a data like this. I need to extract HDID and VNM fields. Any help.

{[-]
BVER : "10.47b",
CHIP : "Bcm7425B1",
EID : 1,
FID : "45",
FVER : "STABLE-KA12.13.05.86-25350.271980",
HCNT : 1,
HDD : [
{[-]
HDID : "W1G016R6",
HID : "W1G016R6",
HMN : "ST1000VM002-9ZL162",
HSZ : "1000.2",
HTYP : 0,
HVC : 2,
VOL : [
{[-]
VNM : "gpfs",
VSZ : 3288
},
{[-]
VNM : "storage",
VSZ : 996916
}
]
}
],
IBTCNT : 6,
MID : "36866",
MT : 1477404,
PID : "832",
SID : "000-00426-37896-246",
TS : "Wed Dec 31 18:00:00 1969"
}

Right now I am able to extract first level of nesting like BVER,CHIP etc. For that My search command is:(just the simple syntax)
sourcetype="agent" | spath path="BVER" output=Bversion |fields Bversion

for spath path="HDD" it is giving the value [{"HDID":"W1G016R6","HID":"W1G016R6","HSZ":1000.2,"HMN":"ST1000VM002-9ZL162","HTYP":0,"HVC":2,"VOL":[{"VNM":"gpfs","VSZ":3288},{"VNM":"storage","VSZ":996916}]}]

Thanks

[stefandagerman]

http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Spath#Examples

Have you tried spath path=HDD.HDID and it didn't work?

It should. and spath path=HDD.VOL.VNM should give you the third level element.