topic Re: How to parse json field? in Getting Data In

How to parse json field?

rodrwan — Fri, 19 Jan 2018 12:41:21 GMT

Hello friends, first of all sorry because my english isn't fluent...

I've been searching similar questions, but anyone solved my problem.

In my search code, I have a JSON geolocalization field as follows:

{'latitude' : '-19.9206813889499', 'longitude' : ' '}

I just want to split it up in two collumns.

How can I do this?

Regards

Re: How to parse json field?

cmerriman — Fri, 19 Jan 2018 13:01:27 GMT

try adding something like this:

|rex field=data "'latitude' : '(?<latitude>.*)', 'longitude' : '(?<longitude>.*)'"

Re: How to parse json field?

mayurr98 — Fri, 19 Jan 2018 13:16:31 GMT

hey

Try this run anywhere search

| makeresults 
| eval _raw="{'latitude' : '-19.9206813889499', 'longitude' : ' '}" 
| rex field=_raw "{'latitude'\s:\s'(?<latitude>[^\']*)',\s'longitude'\s:\s'(?<longitude>[^\']+)"

In your environment you should write,

<your_base_search>
| rex field=_raw "{'latitude'\s:\s'(?<latitude>[^\']*)',\s'longitude'\s:\s'(?<longitude>[^\']+)"

let me know if this helps!

Re: How to parse json field?

rodrwan — Fri, 19 Jan 2018 14:44:48 GMT

Thank you all, the solution posted by mayurr98 have solved my problem!