https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-string-with-special-format-into-objects-or/m-p/593789#M206681 <P class="lia-align-left">Hi there,</P> <P class="lia-align-left">I have trying to use&nbsp;<STRONG>spath&nbsp;</STRONG>to try to extract fields inside a string. Currently, the string has this format..</P> <P>&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="ruby">stringField=["fieldOne": "fieldValue", "fieldTwo": "fieldValue", "fieldThree": "fieldValue"]</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>So, my string inside has some kinda of array with key value pairs. I would to be able to extract those fields and values in a way that I can use their information for my queries.&nbsp;<BR /><BR />I would like to be able to get the value of <STRONG>fieldOne</STRONG> by just calling the <STRONG>fieldOne&nbsp;</STRONG>variable/object to get it's value to perform my desire task/stats and so on..&nbsp;<BR /><BR />I was trying something like... but no luck!</P> <P>&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="ruby">search... | spath input=stringField </LI-CODE><LI-CODE lang="ruby">search... | eval newVariable=spath(_raw,'stringField')</LI-CODE><LI-CODE lang="ruby">search... | spath</LI-CODE><LI-CODE lang="ruby">search... | spath path=stringField output=newField</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>The first option of just using input with the <STRONG>spath</STRONG> command only gave me back the first field inside my string. And it was listed as<STRONG> {}</STRONG> field.<BR /><BR />I would really appreciate the help!</P> Thu, 14 Apr 2022 17:04:47 GMT jvdev 2022-04-14T17:04:47Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-string-with-special-format-into-objects-or/m-p/593789#M206681 <P class="lia-align-left">Hi there,</P> <P class="lia-align-left">I have trying to use&nbsp;<STRONG>spath&nbsp;</STRONG>to try to extract fields inside a string. Currently, the string has this format..</P> <P>&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="ruby">stringField=["fieldOne": "fieldValue", "fieldTwo": "fieldValue", "fieldThree": "fieldValue"]</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>So, my string inside has some kinda of array with key value pairs. I would to be able to extract those fields and values in a way that I can use their information for my queries.&nbsp;<BR /><BR />I would like to be able to get the value of <STRONG>fieldOne</STRONG> by just calling the <STRONG>fieldOne&nbsp;</STRONG>variable/object to get it's value to perform my desire task/stats and so on..&nbsp;<BR /><BR />I was trying something like... but no luck!</P> <P>&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="ruby">search... | spath input=stringField </LI-CODE><LI-CODE lang="ruby">search... | eval newVariable=spath(_raw,'stringField')</LI-CODE><LI-CODE lang="ruby">search... | spath</LI-CODE><LI-CODE lang="ruby">search... | spath path=stringField output=newField</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>The first option of just using input with the <STRONG>spath</STRONG> command only gave me back the first field inside my string. And it was listed as<STRONG> {}</STRONG> field.<BR /><BR />I would really appreciate the help!</P> Thu, 14 Apr 2022 17:04:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-string-with-special-format-into-objects-or/m-p/593789#M206681 jvdev 2022-04-14T17:04:47Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-string-with-special-format-into-objects-or/m-p/593880#M206712 <LI-CODE lang="markup">| eval stringField="{".trim(stringField,"[]")."}" | spath input=stringField</LI-CODE> Fri, 15 Apr 2022 09:41:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-string-with-special-format-into-objects-or/m-p/593880#M206712 ITWhisperer 2022-04-15T09:41:40Z