Getting Data In

How do I split JSON array, twitter hashtags?

moorvogi
Path Finder

i'm having a brain fart at the moment and trying to figure out how to get JUST the hashtags from all the posts. I know there's an app, but i'm sending a custom JSON object to Splunk and can't get it to pull the hashtags back out properly.

considering the following JSON:

{"twitter.handle":"DukeShawZy","twitter.msg":"RT @Patriots: Another TD catch for the RB with the most TD receptions in the @NFL.\n\n@SweetFeet_White | #NEvsCHI | #GoPats https://t.co/OmXQ…","twitter.user":"Andrew WS","twitter.hashtags":"[\"NEvsCHI\",\"GoPats\"]","twitter.created_at":"Sun Oct 21 19:04:48 +0000 2018","twitter.userid":"192657753","my.fetchtime":"2018-10-22 08:40:37"}

i want table output of:

hashtags
-------------
NEvsCHI
GoPats
Tags (2)
0 Karma
1 Solution

493669
Super Champion

if I understand correctly you want hashtags from your raw data, then you can do regex at search time-

|rex max_match=0 "#(?<hashtags>\w+)"

View solution in original post

0 Karma

493669
Super Champion

if I understand correctly you want hashtags from your raw data, then you can do regex at search time-

|rex max_match=0 "#(?<hashtags>\w+)"
0 Karma

moorvogi
Path Finder

that works! thanks!

0 Karma

493669
Super Champion

Glad it works:)
I have converted comment to answer .please accept it.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...