Note: 1) The spath command can be expensive, especially against large data sets 2) If all you need is to parse a string and get the values, consider regular expressions for json data also. In the rex below, I named the a|b|c|d field "foo", in case it had value later on. If not, it doesn't need to be used | makeresults ```creating dummy data based on the original question```
| eval json_data="{data: {a : { x: {value_x} y: {value_y}}} }"
| append
[ makeresults
| eval json_data="{data: {b : { x: {value_x} y: {value_y}}} }"
]
| append
[ makeresults
| eval json_data="{data: {c : { x: {value_x} y: {value_y}}} }"
]
| append
[ makeresults
| eval json_data="{data: {d : { x: {value_x} y: {value_y}}} }"
]
```ending the creation of dummy data```
| rex field=json_data "{(?<foo>\w+)\s:\s{\s\sx:\s{(?<x_value>.+)}\s\sy:\s{(?<y_value>.+)}}}" ```parse strings using a regular expression```
| table json_data x_value y_value ```display results of regular expression in a table``` Results in:
... View more
