i'm having a brain fart at the moment and trying to figure out how to get JUST the hashtags from all the posts. I know there's an app, but i'm sending a custom JSON object to Splunk and can't get it to pull the hashtags back out properly.
considering the following JSON:
{"twitter.handle":"DukeShawZy","twitter.msg":"RT @Patriots: Another TD catch for the RB with the most TD receptions in the @NFL.\n\n@SweetFeet_White | #NEvsCHI | #GoPats https://t.co/OmXQ…","twitter.user":"Andrew WS","twitter.hashtags":"[\"NEvsCHI\",\"GoPats\"]","twitter.created_at":"Sun Oct 21 19:04:48 +0000 2018","twitter.userid":"192657753","my.fetchtime":"2018-10-22 08:40:37"}
i want table output of:
hashtags
-------------
NEvsCHI
GoPats
if I understand correctly you want hashtags from your raw data, then you can do regex at search time-
|rex max_match=0 "#(?<hashtags>\w+)"
if I understand correctly you want hashtags from your raw data, then you can do regex at search time-
|rex max_match=0 "#(?<hashtags>\w+)"
that works! thanks!
Glad it works:)
I have converted comment to answer .please accept it.