Thanks in Advance. 1.I have a json object as content.payload{} and need to extract the values inside the payload.Already splunk extract field as content.payload{} and the result as AP Import flow ...
See more...
Thanks in Advance. 1.I have a json object as content.payload{} and need to extract the values inside the payload.Already splunk extract field as content.payload{} and the result as AP Import flow related results : Extract has no AP records to Import into Oracle". But I want to extract all the details inside the content.payload. How can extract from splunk query or from props.conf file.I tried spath but cant able to get it. 2.How to rename wildcard value of content.payload{}* ? "content" : {
"jobName" : "AP2",
"region" : "NA",
"payload" : [ {
"GL Import flow processing results" : [ {
"concurBatchId" : "4",
"batchId" : "6",
"count" : "50",
"impConReqId" : "1",
"errorMessage" : null,
"filename" : "CONCUR_GL.csv"
} ]
}, "AP Import flow related results : Extract has no AP records to Import into Oracle" ]
},