How can I parse key value pairs from JSON?

[rberman]

Let's say I have the following data that I extracted from JSON into a field called myfield. If I were to print out the values of myfield in a table, for each event, I would have an array of a variable number of key value pairs. 

myfield

{"K1":"V1","K2":"V2","K3":"V3",....."KN":"VN"}

{"A":"X"}

{"B":"Y","C":"Z"}

How do I extract only the values (and not the keys) as a new array for each one?

The output would look like:

my_processed_field

["V1","V2","V3",....."VN"]

["X"]

["Y","Z"]

Help is much appreciated!

Thanks!

[rberman · Accepted solution]

That is in the end how I did it. Thanks @bowesmana! 

| spath output=myfield json_field_with_my_name_value_pairs{}
| eval keys=json_array_to_mv(json_keys(myfield)), my_processed_field=json_array()
| foreach mode=multivalue keys
     [eval my_processed_field=json_append(my_processed_field, "", json_extract_exact(myfield, <<ITEM>>))]

[bowesmana]

Here's an example with your data

| makeresults 
| eval _raw="{\"K1\":\"V1\",\"K2\":\"V2\",\"K3\":\"V3\",\"KN\":\"VN\"}##{\"A\":\"X\"}##{\"B\":\"Y\",\"C\":\"Z\"}"
| eval myfield=split(_raw, "##")
| fields - _raw
| mvexpand myfield
| rex field=myfield max_match=0 "\"\w+\":(?<my_processed_field>\"[^\"]*\")"
| eval my_processed_field="[".mvjoin(my_processed_field, ","). "]"

You want the last two lines rex + eval

[bowesmana]

You could also do it with somewhat convoluted spath + foreach, given the variability of your field names, but as long as your JSON is simply structured, the rex will capture the field values (including quotes) and then join them all up