topic Re: How do I split JSON array, twitter hashtags? in Getting Data In

How do I split JSON array, twitter hashtags?

moorvogi — Mon, 22 Oct 2018 14:18:29 GMT

i'm having a brain fart at the moment and trying to figure out how to get JUST the hashtags from all the posts. I know there's an app, but i'm sending a custom JSON object to Splunk and can't get it to pull the hashtags back out properly.

considering the following JSON:

{"twitter.handle":"DukeShawZy","twitter.msg":"RT @Patriots: Another TD catch for the RB with the most TD receptions in the @NFL.\n\n@SweetFeet_White | #NEvsCHI | #GoPats https://t.co/OmXQ…","twitter.user":"Andrew WS","twitter.hashtags":"[\"NEvsCHI\",\"GoPats\"]","twitter.created_at":"Sun Oct 21 19:04:48 +0000 2018","twitter.userid":"192657753","my.fetchtime":"2018-10-22 08:40:37"}

i want table output of:

hashtags
-------------
NEvsCHI
GoPats

Re: How do I split JSON array, twitter hashtags?

493669 — Mon, 22 Oct 2018 15:26:24 GMT

if I understand correctly you want hashtags from your raw data, then you can do regex at search time-

|rex max_match=0 "#(?<hashtags>\w+)"

Re: How do I split JSON array, twitter hashtags?

moorvogi — Mon, 22 Oct 2018 15:48:36 GMT

that works! thanks!

Re: How do I split JSON array, twitter hashtags?

493669 — Mon, 22 Oct 2018 15:51:21 GMT

Glad it works:)
I have converted comment to answer .please accept it.