How to split json field with backslash separated values?

[norbertt911]

Hi,

I have a json field where multiple values listed separated by backslash in raw (space in list view) like this:

"value": "audit_retention_configure\nos_airdrop_disable......\nsystem_settings_wifi_menu_enable\n"

In list view the extraction looks ok, but the whole list shown as a single value. I would like to split it.

I did this:

Mysearch

| rename "extensionAttribute.value" AS value
| search value="*" AND NOT value="No Base*"
| eval values=split(value,"X")
| mvexpand values
| table values

If i set X="\" (unbalanced quotes), or "\\", or " " (space), there is no change in the result, if I set forexample "_", it will split the field by _ like a charm...

Please advise what should I do for 

audit_retention_configure
nos_airdrop_disable
.
.
.
nsystem_settings_wifi_menu_enable

result.

[norbertt911]

... and finally I found it.

I can't explain why, but if I replace the \n with any random character, the do the split it's works. 

...| rename "extensionAttribute.value" AS value
| search value="*" AND NOT value="No Base*"
| eval value=replace(value,"\\n",";")
| makemv delim=";" value
| mvexpand value
| table value

[enzomialich]

Try: 

| makemv delim="\" value

https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Makemv

[norbertt911]

Thanks,

first of all I just realised that the separator is not just a backslash, but "\n" - new line.

anyway my results are same like with split. makemv do the job too with any delimiter except the \n (\\n,\\\\n or any variation).