Extracting the fields

Tony Reinke - Cribl

Best way to extract fields from this data where the the field and value are separated by a : and the group is delimited by a , ?

{"action": "update", "body": "New token value generated", "name": "user1", "timestamp": "2023-08-24T19:33:22+00:00", "userID": "1"}

David Maislin

Parser since that is JSON

https://docs.cribl.io/stream/parser-function/

David Maislin

Parser since that is JSON

https://docs.cribl.io/stream/parser-function/

Tony Reinke - Cribl

Thanks!

Tony Reinke - Cribl

Make sure when using sample data that the right panel is on Out to see the results