Hello, I want to break the TestTransaction inside testVal values, JSON needs to break up and show all field values inside JSON, how can this search be rewritten?
Splunk search:
index=* sour...
See more...
Hello, I want to break the TestTransaction inside testVal values, JSON needs to break up and show all field values inside JSON, how can this search be rewritten?
Splunk search:
index=* sourcetype=WORKER | fields TestVal
TestVal values:
{"@t":"2020-02-04T22:16:20.8458700Z","@mt":"{@parameters}","parameters":{"info":"Published","message":{"TestTransaction":{"sampleval":"10298684736384305384235533777352","EntryType":141,"CheckNumber":783562,"CheckCloseDate":"2020-02-04T22:16:08.0000000Z","CurrencyCode":"USD","Tenders":[{"Amount":5.3,"Description":"SBUX Card","TenderId":"SV5j8AtfYVm","SvcVal":6147524390259141,"CurrencyCode":null,"$type":"TestTender"}],"TotalAmount":5.3,"SubtotalAmount":4.95,"TaxAmount":0.35,"DiscountAmount":0.0,"Header":{"ServiceType":null,"Number":22,"PosRequestDate":"2020-02-04T22:16:08.0000000Z","$type":"TestHeader"},"Preparation":"ConsumeOutOfStore","TestDetails":{"Discounts":[],"Items":[{"Qty":1.0,"Sku":null,"Price":4.95,"Discounts":[],"Description":null,"Price":null,"Suffix":null,"ChildItems":[],"Commerce":{"Sku":"11105767","edSku":null,"PosStatus":null,"Value":null,"$type":"Commerce"},"Product":{"ProductTypeId":11,"ProductType":"Beverage","ProductNumber":2123078,"FormCode":"salty","SizeCode":"test","LocalDescription":"test","$type":"Product"},"IsRefunded":false,"IsTaxed":false,"Summary":{"TotalPrice":4.95,"DiscountAmount":0,"SubtotalAmount":4.95,"$type":"TestItemSummary"},"$type":"TestItem"}],"Taxes":[{"Name":"State+Local Meals Tax 7%","Amount":35,"$type":"TestTax"}],"ReceiptLines":[],"Delivery":null,"$type":"TestDetails"},"$type":"TestTransaction"},"RequestId":"pos-200204141619-prodrh50592773796","MessageId":"BTxnApi_MID_b6cea268-af3c-4334-85df-c34108e81705","$type":"UpsertTestTransaction"}}}