I have tried to get after.merchantId a million different ways, but it always comes back blank. I believe I'm missing the obvious:
Search String:
sourcetype="json" auditId=RECIPIENT_ADDED | spath | table _time, after.merchantId
...only _time has values, nothing else
sourcetype="json" auditId=RECIPIENT_ADDED | spath | rename after.merchantId as merchantId, after.leadDays as leadDays | eval x=mvzip(merchantId,leadDays) | table _time,merchantId,leadDays,x
...only _time has values, nothing else
Sample JSON:
{
@timestamp: 2018-09-09T19:05:50.077Z
@version: 1
actingProfileType: ALL
after: {"phoneNumber":"8005551212","recipientNumber":"************1111","merchantId":"111111112","paperPaymentEnabled":"true","leadDays":"5","Nickname":"Bob Evans","addressOnFile":"false","recipientName":"Bobby Evans","transferMethod":"PAYMENT","merchantZipRequired":"false","providerStatus":"ACTIVE","merchantName":"Bobby Evans"}
application: BACKOFFICE
auditId: RECIPIENT_ADDED
browserName: Chrome
browserVersion: 68.0.3440.106
clientIp: 192.0.0.1
companyId: 11113
component: PAYMENTS
instanceId: 1abc2345-67de
userId: 11111114
userSourceId: 2fgh3456-89ij
}
... View more
