How to parse json field?

[rodrwan]

Hello friends, first of all sorry because my english isn't fluent...

I've been searching similar questions, but anyone solved my problem.

In my search code, I have a JSON geolocalization field as follows:

{'latitude' : '-19.9206813889499', 'longitude' : ' '}   

I just want to split it up in two collumns.

How can I do this?

Regards

[mayurr98 · Accepted solution]

hey

Try this run anywhere search

| makeresults 
| eval _raw="{'latitude' : '-19.9206813889499', 'longitude' : ' '}" 
| rex field=_raw "{'latitude'\s:\s'(?<latitude>[^\']*)',\s'longitude'\s:\s'(?<longitude>[^\']+)"

In your environment you should write,

<your_base_search>
| rex field=_raw "{'latitude'\s:\s'(?<latitude>[^\']*)',\s'longitude'\s:\s'(?<longitude>[^\']+)"

let me know if this helps!

[rodrwan]

Thank you all, the solution posted by mayurr98 have solved my problem!

[cmerriman]

try adding something like this:

|rex field=data "'latitude' : '(?<latitude>.*)', 'longitude' : '(?<longitude>.*)'"