https://community.splunk.com/t5/Getting-Data-In/Get-a-long-string-in-a-form-of-array-without-using-Rex/m-p/554434#M91886 <P>Can you share a sample anonymised event in a code block &lt;/&gt;&nbsp;</P> Fri, 04 Jun 2021 08:17:12 GMT ITWhisperer 2021-06-04T08:17:12Z https://community.splunk.com/t5/Getting-Data-In/Get-a-long-string-in-a-form-of-array-without-using-Rex/m-p/554198#M91842 <P>Hi Team,</P><P>I have a field that has the data in this format below :</P><P>[ { <SPAN class="t">data data data </SPAN>}],[ {data data data}]</P><P>As you see the data in the Bar and Curly bracket sets are more than one separated by comma however when I used 'stats count by field' or table field only first set of brackets return, anything after comma is dropped.</P><P>With rex I am able to extract the entire string data extracting to new field but I dont want to use Rex on Raw - our company doesnt promote and support it and warn us to not to use it.</P><P>I tried delim=, with makemv, mvcombine etc but it only shows data in first set of bar brackets, rex on field also doesnt show data beyond first set of bar brackets.</P><P>Is there a way to get the entire string by not using rex on Raw but using field itself.</P><P>&nbsp;</P><P>Thanks in advance</P><P>Nishant</P> Thu, 03 Jun 2021 06:03:15 GMT https://community.splunk.com/t5/Getting-Data-In/Get-a-long-string-in-a-form-of-array-without-using-Rex/m-p/554198#M91842 beriwalnishant 2021-06-03T06:03:15Z https://community.splunk.com/t5/Getting-Data-In/Get-a-long-string-in-a-form-of-array-without-using-Rex/m-p/554219#M91848 <P>Why does your company not want you to use the tools available to you?</P><P>If you were allowed to use rex, have you been using max_match=0?</P><P>If this is really JSON (as your tagging seems to suggest) have you tried using spath?</P><P>Do you need the different comma delimited parts to be counted separately, e.g. each part in its own event, if so, have you considered split and mvexpand?</P> Thu, 03 Jun 2021 07:59:24 GMT https://community.splunk.com/t5/Getting-Data-In/Get-a-long-string-in-a-form-of-array-without-using-Rex/m-p/554219#M91848 ITWhisperer 2021-06-03T07:59:24Z https://community.splunk.com/t5/Getting-Data-In/Get-a-long-string-in-a-form-of-array-without-using-Rex/m-p/554412#M91881 <P>Thanks a lot <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;<BR /><BR />Not sure but they reckon it loads the server so they do not promote using rex, thanks I will try spath but with Rex into new field worked like charm.<BR /><BR />It's indeed JSON I forgot to mention it.&nbsp; I did try mvexpand but it doesnt work, for Spath I am unable to work out on what and how to mention in path.</P><P>Thanks</P><P>&nbsp;</P> Fri, 04 Jun 2021 06:52:52 GMT https://community.splunk.com/t5/Getting-Data-In/Get-a-long-string-in-a-form-of-array-without-using-Rex/m-p/554412#M91881 beriwalnishant 2021-06-04T06:52:52Z https://community.splunk.com/t5/Getting-Data-In/Get-a-long-string-in-a-form-of-array-without-using-Rex/m-p/554434#M91886 <P>Can you share a sample anonymised event in a code block &lt;/&gt;&nbsp;</P> Fri, 04 Jun 2021 08:17:12 GMT https://community.splunk.com/t5/Getting-Data-In/Get-a-long-string-in-a-form-of-array-without-using-Rex/m-p/554434#M91886 ITWhisperer 2021-06-04T08:17:12Z