How-To: Reformat a JSON Array using parseJson()

By default, the parseJson() function will turn an array into separate fields. Let's say you have this:

  "Commands": [
    "runscript -Raw=```Get-ChildItem .\n```",
    "update list",
    "update history"

You'd end up with the following fields:


Let's say you want to recombine those into a single field, with each value separated by a \n. Meet the concatArray() function:

// Quick filter that we know will bring back an array. 

// Recombine the "Commands[]" values as "commandsArray" and separate them all by a new line character. 
| concatArray(Commands, as=commandsArray, separator="\n")

// Display the results. 
| select([@timestamp, HostnameField, commandsArray])
Example output:

Figure 14. Example output: