Getting Data In

How to split json field with backslash separated values?

norbertt911
Communicator

Hi,

I have a json field where multiple values listed separated by backslash in raw (space in list view) like this:

"value": "audit_retention_configure\nos_airdrop_disable......\nsystem_settings_wifi_menu_enable\n"

In list view the extraction looks ok, but the whole list shown as a single value. I would like to split it.

I did this:

Mysearch

 

| rename "extensionAttribute.value" AS value
| search value="*" AND NOT value="No Base*"
| eval values=split(value,"X")
| mvexpand values
| table values

 

If i set X="\" (unbalanced quotes), or "\\", or " " (space), there is no change in the result, if I set forexample "_", it will split the field by _ like a charm...

Please advise what should I do for 

audit_retention_configure
nos_airdrop_disable
.
.
.
nsystem_settings_wifi_menu_enable

result.

Labels (2)
0 Karma

norbertt911
Communicator

... and finally I found it.

I can't explain why, but if I replace the \n with any random character, the do the split it's works. 

...| rename "extensionAttribute.value" AS value
| search value="*" AND NOT value="No Base*"
| eval value=replace(value,"\\n",";")
| makemv delim=";" value
| mvexpand value
| table value

0 Karma

enzomialich
Path Finder

norbertt911
Communicator

Thanks,

first of all I just realised that the separator is not just a backslash, but "\n" - new line.

anyway my results are same like with split. makemv do the job too with any delimiter except the \n (\\n,\\\\n or any variation). 

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...