How to extract the values from array?

[mcohen13]

I have a field that his elements looks the following:

["bedep","banjori","gameover","dyre","suppobox","necurs","unknown","conficker","kraken","emotet","mirai","virut","ccleaner"]

How can I only extract the names of the threats with "" from the array on a different field?

[kamlesh_vaghela]

By using split:

| makeresults 
 | eval name="[\"bedep\",\"banjori\",\"gameover\",\"dyre\",\"suppobox\",\"necurs\",\"unknown\",\"conficker\",\"kraken\",\"emotet\",\"mirai\",\"virut\",\"ccleaner\"]"
 | eval new_name = name
 | rex field=new_name mode=sed "s/\[|\]|\"//g"
 | eval new_name = split(new_name,",")

[woodcock]

Like this:

| makeresults 
| eval name="[\"bedep\",\"banjori\",\"gameover\",\"dyre\",\"suppobox\",\"necurs\",\"unknown\",\"conficker\",\"kraken\",\"emotet\",\"mirai\",\"virut\",\"ccleaner\"]"
| eval new_name = name
| rex field=new_name mode=sed "s/[\[\]]//g"
| makemv delim="," new_name
| rex field=new_name mode=sed "s/\"//g"

[vnravikumar]

Hi

Try this

| makeresults 
| eval name="[\"bedep\",\"banjori\",\"gameover\",\"dyre\",\"suppobox\",\"necurs\",\"unknown\",\"conficker\",\"kraken\",\"emotet\",\"mirai\",\"virut\",\"ccleaner\"]" 
| eval result = replace(name, "\[|\]|\"","") 
| makemv delim="," result