title: Splunk : Extracting the elements from JSON structure as separate fields
body: <p>In Splunk, I'm trying to extract the key value pairs inside that &quot;tags&quot; element of the JSON structure so each one of the become a separate column so I can search through them.
  for example :</p>
  <pre><code>| spath data | rename data.tags.EmailAddress AS Email
  </code></pre>
  <p>This does not help though and Email field comes as empty.I'm trying to do this for all the tags. Any thoughts/pointers?</p>
  <pre><code>{
      &quot;timestamp&quot;: &quot;2021-10-26T18:23:05.180707Z&quot;,
      &quot;data&quot;: {
          &quot;tags&quot;: [
              {
                  &quot;key&quot;: &quot;Email&quot;,
                  &quot;value&quot;: &quot;john.doe@example.com&quot;
              },
              {
                  &quot;key&quot;: &quot;ProjectCode&quot;,
                  &quot;value&quot;: &quot;ABCD&quot;
              },
              {
                  &quot;key&quot;: &quot;Owner&quot;,
                  &quot;value&quot;: &quot;John Doe&quot;
              }
          ]
      },
      &quot;field1&quot;: &quot;random1&quot;,
      &quot;field2&quot;: &quot;random2&quot;
  }
  </code></pre>