Thanks in Advance.
1.I have a json object as "content.List of Batches Processed{}" and Already splunk extract field as "content.List of Batches Processed{}.BatchID" and count it showing as 26 .But ...
See more...
Thanks in Advance.
1.I have a json object as "content.List of Batches Processed{}" and Already splunk extract field as "content.List of Batches Processed{}.BatchID" and count it showing as 26 .But in the "content.List of Batches Processed{}.BatchID" we have 134 records. So i want to extract the multiple JSON values as field.From below logs i want to extract all the values from P_REQUEST_ID,P_BATCH_ID,P_TEMPLATE
Query i tried to fetch the data
| eval BatchID=spath("content.List of Batches Processed{}*", "content.List of Batches Processed{}.P_BATCH_ID"),Request=spath(_raw, "content.List of Batches Processed{}.P_REQUEST_ID")|table BatchID Request
"content" : {
"List of Batches Processed" : [ {
"P_REQUEST_ID" : "177",
"P_BATCH_ID" : "1",
"P_TEMPLATE" : "Template",
"P_PERIOD" : "24",
"P_MORE_BATCHES_EXISTS" : "Y",
"P_ZUORA_FILE_NAME" : "Template20240306102852.csv",
"P_MESSAGE" : "Data loaded in RevPro Successfully - Success: 10000 Failed: 0",
"P_RETURN_STATUS" : "SUCCESS"
}, {
"P_REQUEST_ID" : "1r7",
"P_BATCH_ID" : "2",
"P_TEMPLATE" : "Template",
"P_PERIOD" : "24",
"P_MORE_BATCHES_EXISTS" : "Y",
"P_ZUORA_FILE_NAME" : "Template20240306102852.csv",
"P_MESSAGE" : "Data loaded in RevPro Successfully - Success: 10000 Failed: 0",
"P_RETURN_STATUS" : "SUCCESS"
}, {
"P_REQUEST_ID" : "1577",
"P_BATCH_ID" : "3",
"P_TEMPLATE" : "Template",
"P_PERIOD" : "24",
"P_MORE_BATCHES_EXISTS" : "Y",
"P_ZUORA_FILE_NAME" : "Template20240306102852.csv",
"P_MESSAGE" : "Data loaded in RevPro Successfully - Success: 10000 Failed: 0",
"P_RETURN_STATUS" : "SUCCESS"
}, {
"P_REQUEST_ID" : "16577",
"P_BATCH_ID" : "4",
"P_TEMPLATE" : "Template",
"P_PERIOD" : "24",
"P_MORE_BATCHES_EXISTS" : "Y",
"P_ZUORA_FILE_NAME" : "Template20240306102852.csv",
"P_MESSAGE" : "Data loaded in RevPro Successfully - Success: 10000 Failed: 0",
"P_RETURN_STATUS" : "SUCCESS"
}
.