topic Re: Help with json field with backslash separated values? in Getting Data In

How to split json field with backslash separated values?

norbertt911 — Thu, 11 May 2023 12:23:33 GMT

Hi,

I have a json field where multiple values listed separated by backslash in raw (space in list view) like this:

"value": "audit_retention_configure\nos_airdrop_disable......\nsystem_settings_wifi_menu_enable\n"

In list view the extraction looks ok, but the whole list shown as a single value. I would like to split it.

I did this:

Mysearch

If i set X="\" (unbalanced quotes), or "\\", or " " (space), there is no change in the result, if I set forexample "_", it will split the field by _ like a charm...

Please advise what should I do for

audit_retention_configure
nos_airdrop_disable
.
.
.
nsystem_settings_wifi_menu_enable

result.

Re: json field with backslash separated values

enzomialich — Wed, 10 May 2023 12:05:13 GMT

Try:

| makemv delim="\" value

https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Makemv

Re: json field with backslash separated values

norbertt911 — Thu, 11 May 2023 07:41:34 GMT

Thanks,

first of all I just realised that the separator is not just a backslash, but "\n" - new line.

anyway my results are same like with split. makemv do the job too with any delimiter except the \n (\\n,\\\\n or any variation).

Re: Help with json field with backslash separated values?

norbertt911 — Thu, 11 May 2023 07:49:25 GMT

... and finally I found it.

I can't explain why, but if I replace the \n with any random character, the do the split it's works.