How to rename JSON array of values

[Bhargavi21]

Please help me with the below  query 

I am using below query to extract array of json data

search storeAction="storeOffline" | eval OfflineStoreID = spath(_raw,"stores{}")

I am able to evaluate the list, like

TestT001

TestT002

Test0000

Test1000

Test2000

Test3000

I want the list which should have only ID's and I should remove Test. which should be as below

T001

T002

0000

1000

2000

3000

Please let me know how to do this.

[bowesmana]

You can use rex on a multivalue field like this

| makeresults
| eval Stores="TestT001,TestT002,Test0000,Test1000,Test2000,Test3000"
| eval Stores=split(Stores,",")
| rex field=Stores mode=sed "s/Test//g"

Hope this helps 

[Bhargavi21]

Thank you 🙂 It is working and solved my issue.