Hi @venkatanagendra , If the json you provided is part of an already existing field i would go with eval json functions | makeresults
| eval json = "{\"IsProductValidated\":\"false\",\"ErrorCodes\":[{\"errorCode\":\"PRD-202\",\"errorMessage\":\"Product Validation Service Returned Error :: Reason: Options you have selected are not available at this time. Please change your selections.\"}]}"
| eval errorCode = json_extract(json,"ErrorCodes{}.errorCode"), errorMessage = json_extract(json,"ErrorCodes{}.errorMessage")
| table _time errorCode errorMessage Best Regards, Andreas
... View more