Parsing out a 32-char GUID from a nested JSON array

[nickchow]

I have a JSON object in Splunk that looks something like this:

{
  "myArr": [
    [
      "redbull",
      "2;2cf77a02b5f047bbb1ae4522d9e614a6;OpAJa;1YdsW;3Z;zs"
    ],
    ... <more arrays> ...
  ]
}

What I'd like to do is:

1. Pull out the nested array that has a first value of "redbull"
2. Pull out the 2nd string from the nested array.
3. Pull out the 2nd semicolon delimited item from that string.

In this particular example, what I want is:

2cf77a02b5f047bbb1ae4522d9e614a6

Can anyone assist with this?

[niketnilay]

@nickchow, you can use spath to parse JSON data (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath)
If you have enabled KV_MODE=json in props.conf for your data your JSON data should already be extracted without the spath command (https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#Field_extraction_configuration).

Following is a run anywhere search to mock up data as per question, you can add the command from | spath to your base search in your case:

|  makeresults
|  eval _raw="{
   \"myArr\":
     [
       \"redbull\",
       \"2;2cf77a02b5f047bbb1ae4522d9e614a6;OpAJa;1YdsW;3Z;zs\"
     ]
 }"
 |  spath
 |  rename "myArr{}" as "myArr"
 |  eval arr1=mvindex(myArr,0)
 |  eval arr2=mvindex(myArr,1)
 |  eval arr2=split(arr2,";")
 |  eval guid=mvindex(arr2,1)
 |  table _raw myArr arr1 arr2 guid