https://docs.splunk.com/Documentation/SCS/current/SearchReference/JSONFunctions   cities is not the JSON field yet, I guess. ... View more

Hey! Thanks so much for this!! The OP's problem was nearly identical to mine. I'm parsing thru Ansible's win_update JSon and they put in this stupid GUID thing for an object name...anyway... I didn't know about having to pre populate my field for the foreach! I can't tell you how many hours and hours I spent wondering why, oh why, doesn't my foreach concatonation work??? I am totally stealing this from you.  | eval upd_kb="" | foreach ansible_result.filtered_updates.*.kb{} [eval upd_kb=upd_kb.if(upd_kb=="","",if(isnull('<<FIELD>>'),"",",")).if(isnull('<<FIELD>>'),"",'<<FIELD>>') ] | table upd_kb I'm not sure if I'll need the isnull check, but it sure couldn't hurt to have! Thanks!! J ... View more