topic How to extract the values from array? in Knowledge Management

How to extract the values from array?

mcohen13 — Mon, 18 Mar 2019 14:09:51 GMT

I have a field that his elements looks the following:

["bedep","banjori","gameover","dyre","suppobox","necurs","unknown","conficker","kraken","emotet","mirai","virut","ccleaner"]

How can I only extract the names of the threats with "" from the array on a different field?

Re: How to extract the values from array?

vnravikumar — Mon, 18 Mar 2019 14:23:37 GMT

Try this

| makeresults 
| eval name="[\"bedep\",\"banjori\",\"gameover\",\"dyre\",\"suppobox\",\"necurs\",\"unknown\",\"conficker\",\"kraken\",\"emotet\",\"mirai\",\"virut\",\"ccleaner\"]" 
| eval result = replace(name, "\[|\]|\"","") 
| makemv delim="," result

Re: How to extract the values from array?

woodcock — Mon, 18 Mar 2019 15:51:21 GMT

Like this:

| makeresults 
| eval name="[\"bedep\",\"banjori\",\"gameover\",\"dyre\",\"suppobox\",\"necurs\",\"unknown\",\"conficker\",\"kraken\",\"emotet\",\"mirai\",\"virut\",\"ccleaner\"]"
| eval new_name = name
| rex field=new_name mode=sed "s/[\[\]]//g"
| makemv delim="," new_name
| rex field=new_name mode=sed "s/\"//g"

Re: How to extract the values from array?

kamlesh_vaghela — Tue, 19 Mar 2019 06:49:21 GMT

By using split:

| makeresults 
 | eval name="[\"bedep\",\"banjori\",\"gameover\",\"dyre\",\"suppobox\",\"necurs\",\"unknown\",\"conficker\",\"kraken\",\"emotet\",\"mirai\",\"virut\",\"ccleaner\"]"
 | eval new_name = name
 | rex field=new_name mode=sed "s/\[|\]|\"//g"
 | eval new_name = split(new_name,",")