Hello
I am beginner with Splunk. I made a query and my search result is like
text1 text2 text3 response: {
"status":"UP",
"object1":{
"field1":"name1",
"status":"UP"
},
"object2":{
"field2":"name2",
"status":"UP"
},
"object3":{
"object4":{
"field4":"name4",
"status":"UP"
},
"object5":{
"field5":"name5",
"status":"UP"
},
"status":"UP"
},
"object6":{
"field6":"name6",
"status":"UP"
}
}
I want to obtain the value for object3.status for a column of table. How to do this ? With rex field=_raw or spath ?
Thank you in advance.
... View more