If that is really the actual event, the developers deserve spanking. This is not conformant JSON but near garbage. First off, the nodes are not properly separated by comma. Secondly, keys and text values are not properly quoted all the way through. Is it possible that the actual "actual" event format is like this instead? {"event_disabled": false,
"internal_event_id": "124578_1245",
"name": "ELEMENT_EVENT",
"element_list": {"list_element":[{"element": "{\"var1\":\"1.1.8.8:443\",\"var2\":\"1188\"}"},{"element": "{\"var1\":\"8.8.1.1:443\",\"var2\":\"8811\"}"},{"element": "{\"var1\":\"1.2.3.4:443\",\"var2\":\"1234\"}"}]},
"phone_number": 123456789
} It is extremely important to present accurate data if you want to get concrete help (as opposed to seek general ideas). Meanwhile, if the data is as I posted above, Splunk would have already given you a multivalue field named element_list.list_element{}.element. You'll need to run mvexpand on that as @ITWhisperer suggested, then spath again. | mvexpand element_list.list_element{}.element
| spath input=element_list.list_element{}.element
| table var1 var2
... View more