I have an array that would be presented in an API response which is being logged in Splunk and the array format is like this: "Indicators": [                 "HAS_ACOUNT",                 "NON_ZERO_BALANCE_ACCOUNT",                 "JOINT_ACCOUNT",                 "NOT_EXPIRED",                 "REGISTERED"             ]   The number of values within the array will not always have same pattern. i.e. There may be responses where there may be 10 values within 'Indicators' array.   Now, I want to extract distinct values within "Indicators" array (with the value that has the text "ACCOUNT") logged in Splunk for last 30 days from that specific API response. Could someone help me how to get that?   I wrote like this, but is didn't quite capture all possible values.. index="index_name" Env=test "........./API" | rex field=_raw "\"Indicators\"\:\[(?<planInd>[^\,]*)\]" max_match=0 | where like (planInd,"%PCP%") | dedup planInd | table planInd ... View more