I agree with @ITWhisperer . and your sample JSON looks like an array of objects also. So please share a masked event here. Meanwhile, I'm sharing a sample query so that you can start on the solu...
See more...
I agree with @ITWhisperer . and your sample JSON looks like an array of objects also. So please share a masked event here. Meanwhile, I'm sharing a sample query so that you can start on the solution. | makeresults
| eval params="[{'field1':'value1','field2':'value2','field3':'value3','field4':'value4'}]"
| rename comment as "upto now is sample data only"
| eval params = replace(params, "'","\"")
| eval _raw = params
| spath I have handled a single quote here. if you have valid JSON then just remove `| eval params = replace(params, "'","\"")` . Thanks KV