I am trying to extract the key/value pairs in this Json field:
[DataJson={"Code":"Error","Reason":"Failed
to locate your record. Message [No
record]"}]
I tried doing this:
spath | rename Code AS Code, Reason AS Reason | table _time, Code, Reason
I only get values for _time, but not for Code and Reason. I would appreciate your help.
Thanks in advance
Try extracting field of DataJson and then running spath on that field...
search with rex to extract DataJson | spath input=DataJson
Did not doublecheck syntax.
I think spath doesn't like the format of your JSON field.
Try this instead:
your search here
| rex field=_raw "(?msi)^\[[^=]+=(?<my_json>.+)\]$"
| spath input=my_json
| rename Code AS Code, Reason AS Reason
| table _time, Code, Reason
Still only returned values for _time
Is the my_json field getting extracted correctly? Starting and ending with {}? If not you will need to tweak regex.
{"Code":"Error","Reason":"Failed to locate your record. Message [Norecord]"}