IF the _raw is the same as above, I want to search with the query below. Index=_internal sourcetype=splunkd   I want to use the map command with the contents of the C column. Without putting A and B columns in the map command NO  ->>  | map search="search earliest=-1d@d latest=now index=$a$ sourcetype=$b$"   I used this SPL, but it did not produce the desired result. | map search="search earliest=-1d@d latest=now $c$" I guess this query seems to mean this. search earliest=-1d@d latest=now index=$a$ sourcetype=$b$   Help, Variable string processing in variable string in map command. Please ... View more

Please help me! I have indexed JSON data, but I cannot extract the data as I want. Below is the raw data. ####RAW DATA { "username": "nsroot", "resourceName": "", "ns": [ { "network_interfaces": [ { "port_name": "LA/1" }, { "port_name": "10/2" }, { "port_name": "10/1" } ], "ip_address": "172.16.30.131", "instance_state": "Up" }, { "network_interfaces": [ { "port_name": "10/2" }, { "port_name": "LA/1" }, { "port_name": "10/1" } ], "ip_address": "172.16.30.81", "instance_state": "Up" }, { "network_interfaces": [ { "port_name": "10/1" }, { "port_name": "10/16" }, { "port_name": "LA/8" }, { "port_name": "LA/1" }, { "port_name": "10/2" }, { "port_name": "10/15" } ], "ip_address": "172.16.30.181", "instance_state": "Up" } ], "errorcode": 0, "operation": "get", "resourceType": "ns", "tenant_name": "Owner", "message": "Done" } I want to make the following result from the original data, but I do not know how to write the query. Help me, Please! ... View more