https://community.splunk.com/t5/Splunk-Search/How-to-remove-in-Json-format-data/m-p/598007#M208237 <LI-CODE lang="markup">| eval field=trim(field,"[]")</LI-CODE> Mon, 16 May 2022 22:04:53 GMT ITWhisperer 2022-05-16T22:04:53Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-in-Json-format-data/m-p/597981#M208223 <P>I have a field properties.policies&nbsp; in json format&nbsp;</P> <P>field value: [{"fieldname":"fieldvalue","fieldname":"fieldvalue","fieldname":"fieldvalue",[priview]&nbsp;"fieldname":"fieldvalue",[]}]</P> <P>i want to remove first and last [] so that other fields can populate&nbsp;</P> <P>can some one send me the rex please ?</P> <P>Thanks in advance</P> <P>&nbsp;</P> Mon, 16 May 2022 17:00:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-in-Json-format-data/m-p/597981#M208223 vikram1583 2022-05-16T17:00:34Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-in-Json-format-data/m-p/597983#M208225 <P>What have you tried so far?&nbsp;</P><P>Parsing JSON using regular expressions can be challenging.&nbsp; Have you tried the <FONT face="courier new,courier">spath</FONT> command?</P> Mon, 16 May 2022 17:05:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-in-Json-format-data/m-p/597983#M208225 richgalloway 2022-05-16T17:05:40Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-in-Json-format-data/m-p/598007#M208237 <LI-CODE lang="markup">| eval field=trim(field,"[]")</LI-CODE> Mon, 16 May 2022 22:04:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-in-Json-format-data/m-p/598007#M208237 ITWhisperer 2022-05-16T22:04:53Z