{"id":31167,"date":"2021-03-01T15:52:33","date_gmt":"2021-03-01T15:52:33","guid":{"rendered":"https:\/\/merikebi.warrenmyers.com\/?p=31167"},"modified":"2021-03-01T15:52:33","modified_gmt":"2021-03-01T15:52:33","slug":"answer-by-warren-for-print-string-array-of-a-json-payload-in-splunk","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=31167","title":{"rendered":"Answer by warren for Print String array of a json payload in splunk"},"content":{"rendered":"<p>If this data is being brought-in a JSON, you won&#8217;t have to <code>rex<\/code> it out<\/p>\n<p>If not, though, the issue is your regular expression<\/p>\n<p>Try it out on regex101.com &#8211; you&#8217;ll see you&#8217;re <em>only<\/em> grabbing the first value because you&#8217;re stopping at a literal <code>&quot;<\/code><\/p>\n<p>Try this instead:<\/p>\n<pre><code>...\n| rex field=_raw &quot;codes\\&quot;:\\[(?&lt;codes&gt;[^\\]]+)&quot;\n| eval codes=split(replace(codes,&quot;\\&quot;,&quot;&quot;),&quot;,&quot;)\n<\/code><\/pre>\n<p>That will make <code>codes<\/code> into a multivalue field<\/p>\n<p>If you don&#8217;t care about it being multivalue, you can just do:<\/p>\n<pre><code>| eval codes=replace(codes,&quot;\\&quot;&quot;,&quot;&quot;)\n<\/code><\/pre>\n<p>to pull the quote marks<\/p>\n<p>from User warren &#8211; Stack Overflow https:\/\/stackoverflow.com\/questions\/66422836\/print-string-array-of-a-json-payload-in-splunk\/66425124#66425124<br \/>\nvia <a href=\"https:\/\/ifttt.com\/?ref=da&#038;site=wordpress\">IFTTT<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>If this data is being brought-in a JSON, you won&#8217;t have to rex it out If not, though, the issue is your regular expression Try it out on regex101.com &#8211; you&#8217;ll see you&#8217;re only grabbing the first value because you&#8217;re stopping at a literal &quot; Try this instead: &#8230; | rex field=_raw &quot;codes\\&quot;:\\[(?&lt;codes&gt;[^\\]]+)&quot; | eval &hellip;<br \/><a href=\"https:\/\/merikebi.warrenmyers.com\/?p=31167\" class=\"more-link pen_button pen_element_default pen_icon_arrow_double\">Continue reading <span class=\"screen-reader-text\">Answer by warren for Print String array of a json payload in splunk<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[991],"keyring_services":[],"class_list":["post-31167","post","type-post","status-publish","format-standard","hentry","category-blih","tag-stackexchange"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/31167","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=31167"}],"version-history":[{"count":1,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/31167\/revisions"}],"predecessor-version":[{"id":31168,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/31167\/revisions\/31168"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=31167"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=31167"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=31167"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=31167"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}