Hi @DarthHerm Is this what you are looking for? From your original search you should be able to do: | eval params=json_array_to_mv(json_extract(_raw,"parameters"))
| eval newParams="{}"
| ...
See more...
Hi @DarthHerm Is this what you are looking for? From your original search you should be able to do: | eval params=json_array_to_mv(json_extract(_raw,"parameters"))
| eval newParams="{}"
| foreach mode=multivalue params
[| eval newParams=json_set(newParams,json_extract(<<ITEM>>,"name"),json_extract(<<ITEM>>,"value"))]
| spath input=newParams
| table accessDate, userName, serverHost, @SparklingTypeId, @PageSize, @PageNumber Below is a full example to get you started: | windbag
| head 1
| eval _raw="{\"auditResultSets\":null,\"schema\":\"com\",\"storedProcedureName\":\"SpongeGetBySearchCriteria\",\"commandText\":\"com.SpongeGetBySearchCriteria\",\"Locking\":null,\"commandType\":4,\"parameters\":[{\"name\":\"@RETURN_VALUE\",\"value\":0},{\"name\":\"@SpongeTypeId\",\"value\":null},{\"name\":\"@CustomerNameStartWith\",\"value\":null},{\"name\":\"@IsAssigned\",\"value\":null},{\"name\":\"@IsAssignedToIdIsNULL\",\"value\":false},{\"name\":\"@SpongeStatusIdsCSV\",\"value\":\",1,\"},{\"name\":\"@RequestingValueId\",\"value\":null},{\"name\":\"@RequestingStaffId\",\"value\":null},{\"name\":\"@IsParamOther\",\"value\":false},{\"name\":\"@AssignedToId\",\"value\":null},{\"name\":\"@MALLLocationId\",\"value\":8279},{\"name\":\"@AssignedDateFrom\",\"value\":null},{\"name\":\"@AssignedDateTo\",\"value\":null},{\"name\":\"@RequestDateFrom\",\"value\":null},{\"name\":\"@RequestDateTo\",\"value\":null},{\"name\":\"@DueDateFrom\",\"value\":null},{\"name\":\"@DueDateTo\",\"value\":null},{\"name\":\"@ExcludeCustomerFlagTypeIdsCSV\",\"value\":\",1,\"},{\"name\":\"@PageSize\",\"value\":25},{\"name\":\"@PageNumber\",\"value\":1},{\"name\":\"@SortColumnName\",\"value\":\"RequestDate\"},{\"name\":\"@SortDirection\",\"value\":\"DESC\"},{\"name\":\"@HasAnySparkling\",\"value\":null},{\"name\":\"@SparklingTypeId\",\"value\":null},{\"name\":\"@SparklingSubTypeId\",\"value\":null},{\"name\":\"@SparklingStatusId\",\"value\":null},{\"name\":\"@SparklingDateFrom\",\"value\":null},{\"name\":\"@SparklingDateTo\",\"value\":null},{\"name\":\"@SupervisorId\",\"value\":null},{\"name\":\"@Debug\",\"value\":null}],\"serverIPAddress\":\"255.255.000.000\",\"serverHost\":\"WEBSERVER\",\"clientIPAddress\":\"255.255.255.255\",\"sourceSystem\":\"WebSite\",\"module\":\"Vendor.Product.BLL.Community\",\"accessDate\":\"2025-04-30T15:34:33.3568918-06:00\",\"userId\":3231,\"userName\":\"PeterVenkman\",\"traceInformation\":[{\"type\":\"Page\",\"class\":\"Vendor.Product.Web.UI.Website.Community.Operations.SpongeSearch\",\"method\":\"Page_Load\"},{\"type\":\"Manager\",\"class\":\"Vendor.Product.BLL.Community.SpongeManager\",\"method\":\"SpongeSearch\"}]}"
| fields _raw
| spath
| eval params=json_array_to_mv(json_extract(_raw,"parameters"))
| eval newParams="{}"
| foreach mode=multivalue params
[| eval newParams=json_set(newParams,json_extract(<<ITEM>>,"name"),json_extract(<<ITEM>>,"value"))]
| spath input=newParams
| table accessDate, userName, serverHost, @SparklingTypeId, @PageSize, @PageNumber Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing