{ [-]
detailMap: { [-]
critical: false
result: 0
totalCnt: 5
txnCountWithIgnoredIRC: 0
warning: false
}
id: 60300000000
name: EBALL
}
I'm trying to extract totalCount out of the nested Json. I'm trying the below search to extract it:
index="pas" source="agent.log" | spath output=myCount path=detailMap{}.totalCnt | table myCount
When I'm running this search, myCount column is blank.
Please let me know how to improvise this search.
| makeresults
| eval _raw = "{
\"detailMap\": {
\"critical\": \"false\",
\"result\": \"0\",
\"totalCnt\": \"5\",
\"txnCountWithIgnoredIRC\": \"0\",
\"warning\": \"false\"
},
\"id\": \"60300000000\",
\"name\": \"EBALL\"
}"
| spath
From this results,
index="pas" source="agent.log"
| spath output=myCount path=detailMap.totalCnt
| table myCount
It looks like the field name is different.
Hi
Try this
| makeresults
| eval temp="{
\"detailMap\": {
\"critical\": false,
\"result\": 0,
\"totalCnt\": 5,
\"txnCountWithIgnoredIRC\": 0,
\"warning\": false
},
\"id\": 60300000000,
\"name\": \"EBALL\"
}"
| spath input=temp output=totalCnt path=detailMap{}.totalCnt | table totalCnt