<?php $re = '/"_raw": (.*)(?=,)/m'; $str = '{ "result": { "_raw": "Jun 30 06:51:04 blablabla.com apache2: event_id="something" event="something" app="testapp" serial_number="066f1cda" revoke_reason="key compromise" revoke_comment="xxxxxx" delay_revoke="15" url="/blablabla.php" account_id="123456" user_id="xxxxxxx" staff_id="xxxx" staff_name="todd" ip_address="123.123.123.123"", "splunk_server": "splunkin02.localhost.com" }, "results_link": "https://splunk.sffew.com", "app": "search", "search_name": "TEST", "owner": "toodles@sfsfe.com", "sid": "scheduler_blahlahlah" }'; preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0); $parsable_array = explode(' ',$matches[0][1]); $expected_array = array_filter($parsable_array, function ($var) { return (stripos($var, '=') != false); }); $final_result = []; foreach($expected_array as $str){ list($key,$value) = explode('=',$str); $final_result[$key] = trim($value,'"'); } print_r($final_result); ?>
You have javascript disabled. You will not be able to edit any code.