Hi there, I have this type of event coming into splunk:
```
[redacted:54407 24943076666] Processing MessageDispatcher.deliver_batch([#<Message::Queued:0x0000aaab14d8f418 @id=10440927, @created_at=Fri, 03 Jun 2022 14:21:43.890133282 UTC +00:00>, #<Message::Queued:0x0000aaab14dbc8c8 @id=10440928, @created_at=Fri, 03 Jun 2022 14:21:43.896693884 UTC +00:00>]{"tag":"something","strand":null,"singleton":null,"priority":25,"attempts":0,"created_at":"2022-06-03T14:21:43Z","max_attempts":15,"source":"hostname:redacted,pid:29920"}
```
I would like to extract all of the json fields dynamically without individually pulling them out with multiple rex's. I have tried the following, but I am not seeing the json fields being parsed. `myjson` is successfully extracted, but spath does not pull out individual fields from the json:
```
index="myindex" source="mysource"
| rex field=_raw "(?<myjson>\{.+\})"
| spath myjson
```
@zachsisinst - It should be:
| spath input=myjson
Here is my working search query:
| makeresults | eval _raw="[redacted:54407 24943076666] Processing MessageDispatcher.deliver_batch([#<Message::Queued:0x0000aaab14d8f418 @id=10440927, @created_at=Fri, 03 Jun 2022 14:21:43.890133282 UTC +00:00>, #<Message::Queued:0x0000aaab14dbc8c8 @id=10440928, @created_at=Fri, 03 Jun 2022 14:21:43.896693884 UTC +00:00>]{\"tag\":\"something\",\"strand\":null,\"singleton\":null,\"priority\":25,\"attempts\":0,\"created_at\":\"2022-06-03T14:21:43Z\",\"max_attempts\":15,\"source\":\"hostname:redacted,pid:29920\"}"
| rex field=_raw "(?<myjson>\{.+\})"
| spath input=myjson
I hope this helps!!!
@zachsisinst - It should be:
| spath input=myjson
Here is my working search query:
| makeresults | eval _raw="[redacted:54407 24943076666] Processing MessageDispatcher.deliver_batch([#<Message::Queued:0x0000aaab14d8f418 @id=10440927, @created_at=Fri, 03 Jun 2022 14:21:43.890133282 UTC +00:00>, #<Message::Queued:0x0000aaab14dbc8c8 @id=10440928, @created_at=Fri, 03 Jun 2022 14:21:43.896693884 UTC +00:00>]{\"tag\":\"something\",\"strand\":null,\"singleton\":null,\"priority\":25,\"attempts\":0,\"created_at\":\"2022-06-03T14:21:43Z\",\"max_attempts\":15,\"source\":\"hostname:redacted,pid:29920\"}"
| rex field=_raw "(?<myjson>\{.+\})"
| spath input=myjson
I hope this helps!!!