Getting Data In

How do I split JSON array, twitter hashtags?

moorvogi
Path Finder

i'm having a brain fart at the moment and trying to figure out how to get JUST the hashtags from all the posts. I know there's an app, but i'm sending a custom JSON object to Splunk and can't get it to pull the hashtags back out properly.

considering the following JSON:

{"twitter.handle":"DukeShawZy","twitter.msg":"RT @Patriots: Another TD catch for the RB with the most TD receptions in the @NFL.\n\n@SweetFeet_White | #NEvsCHI | #GoPats https://t.co/OmXQ…","twitter.user":"Andrew WS","twitter.hashtags":"[\"NEvsCHI\",\"GoPats\"]","twitter.created_at":"Sun Oct 21 19:04:48 +0000 2018","twitter.userid":"192657753","my.fetchtime":"2018-10-22 08:40:37"}

i want table output of:

hashtags
-------------
NEvsCHI
GoPats
Tags (2)
0 Karma
1 Solution

493669
Super Champion

if I understand correctly you want hashtags from your raw data, then you can do regex at search time-

|rex max_match=0 "#(?<hashtags>\w+)"

View solution in original post

0 Karma

493669
Super Champion

if I understand correctly you want hashtags from your raw data, then you can do regex at search time-

|rex max_match=0 "#(?<hashtags>\w+)"
0 Karma

moorvogi
Path Finder

that works! thanks!

0 Karma

493669
Super Champion

Glad it works:)
I have converted comment to answer .please accept it.

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...