Hi All, Our data ingested into our Index are in proper JSON format & Splunk is converting into JSON object automatically , but I'm unable to extract/access any of the child object along with its nested attributes. Example : { "name": "notificationService", "requestId": "ee76e5cf-90cc-521f-bc96-bdf6f39f5bc8", "parsedEvent": { "event": { "eventName": "Notification", "timestamp": "2020-11-26T18:55:14.000+11:00", "delivery": "NotifierSystem", "notificationEventType": "EMAIL" }, "metadata": { "correlationId": "1603246877854" } }, "msg": "Starting to process event", "time": "2020-11-26T08:02:39.123Z" } Search query : .... | table requestId, name, parsedEvent.metadata.correlationId, parsedEvent.event Is getting me : ee76e5cf-90cc-521f-bc96-bdf6f39f5bc8,notificationService, 1603246877854,<blank> If you see, I'm not able to get the "parsedEvent.event" object along with its child attributes, but i'm able to access "parsedEvent.metadata.correlationId" successfully which doesn't have any child. Any help would be appreciated. Thanks in Advance.
... View more