title: How to extract Key Value fields from Json string in Splunk
body: <p>I have json format Splunk search results like below :</p>
  <pre><code>&quot;{
      &quot;Name&quot;: &quot;RUNQDATA&quot;,
      &quot;RunId&quot;: &quot;2021021701&quot;,
      &quot;Details&quot;: &lt;{
          &quot;RunQID&quot;: &quot;796562&quot;,
          &quot;TQID&quot;: &quot;796562&quot;,
          &quot;Ent&quot;: {
              &quot;NAME&quot;: &quot;Inv&quot;,
              &quot;Store&quot;: {
                  &quot;NAME&quot;: &quot;FSW&quot;,
                  &quot;TYPE&quot;: &quot;QUEUE&quot;,
                  &quot;USERNAME&quot;: &quot;abc&quot;
              }
          },
          &quot;ADD_COUNT&quot;: &quot;5740&quot;,
          &quot;UPDATE_COUNT&quot;: &quot;0&quot;,
          &quot;DELETE_COUNT&quot;: &quot;0&quot;
      }&gt;,
      &quot;status&quot;: &quot;success&quot;,
  }&quot; 
  </code></pre>
  <p>How can I extract the fields like ADD_COUNT or UPDATE_COUNT from this ? I tried spath &amp; other options , however not able to get the required results. Probably because the json contains &lt;&gt;.</p>
  <p>Any help here is appreciated.</p>