| makeresults
| eval _raw="\"assets\":[{\"id\":1,\"last_seen_time\":\"2020-02-26T16:23:06Z\",\"network_ports\":[{\"id\":100,\"port_number\":111,\"extra_info\":\"\",\"hostname\":null,\"name\":\"unknown\",\"ostype\":\"\",\"product\":null,\"protocol\":\"tcp\",\"state\":\"open\",\"version\":null},{\"id\":343,\"port_number\":444,\"extra_info\":\"\",\"hostname\":null,\"name\":\"unknown\",\"ostype\":\"\",\"product\":null,\"protocol\":\"tcp\",\"state\":\"open\",\"version\":null}],\"tags\":[\"Loc: Ajay\"],\"owner\":null,\"urls\":{\"vulnerabilities\":\"google.com/examples/1012/tests\"},\"ip_address\":\"1.1.0.91\",\"database\":null,\"hostname\":\"swetha\",\"asset_groups\":[{\"id\":191300,\"name\":\"All examples\"}]},{\"id\":1012,\"last_seen_time\":\"2020-02-26T16:23:06Z\",\"network_ports\":[{\"id\":331,\"port_number\":135,\"extra_info\":\"\",\"hostname\":null,\"name\":\"unknown\",\"ostype\":\"\",\"product\":null,\"protocol\":\"tcp\",\"state\":\"open\",\"version\":null},{\"id\":343,\"port_number\":444,\"extra_info\":\"\",\"hostname\":null,\"name\":\"unknown\",\"ostype\":\"\",\"product\":null,\"protocol\":\"tcp\",\"state\":\"open\",\"version\":null}],\"tags\":[\"Loc: NorthCEE\"],\"owner\":null,\"urls\":{\"vulnerabilities\":\"google.com/examples/2/tests\"},\"ip_address\":\"1.1.0.92\",\"database\":null,\"hostname\":\"sweety\",\"asset_groups\":[{\"id\":191300,\"name\":\"All exs\"}]}]"
| rex mode=sed "s/(.*)/{\1}/"
| spath
This query works. If you want only searching, try this rex and spath
I guess your JSON is not valid.
recommed props.conf
[your sourcetype]
SEDCMD-add_header = s/(.*)/{\1}/
KV_MODE=json
... View more