Access returned values from String Function

[d_patel_dj]

Hi All, 

Does anyone know how I access the returned values from a string function. 

My current use case: 

1. I am using the string function, specifically the "split" function to split the current input via a comma:  ['user@email', 'user2@email'] 
2. When I review the returned results in the "technical details" tab I can see in the JSON result has two values returned: 
   1. 0 user@email
   2. 1user2@email
3. When I attempt to view the results via [Functions_String Functions_1.JsonResult] it doesn't let me specify which key I would like (1), and so returns the array back to me. 

The goal is to split the two emails and only return the "user2@email" as I would like to use that value in a UDM query down the line. 

Any idea how to achieve this? 

Thanks 

[ylandovskyy]

Hey @d_patel_dj,

What kind of situations can we expect inside the playbook? Will it always be only 2 values and you would need to use the second one or there can be other permutations that we need to keep in mind?

[d_patel_dj]

Hi @ylandovskyy , 

In this occasion yes, as my company has a legacy email and a current email address which gets pulled through within the entra alerts. The goal is to run a custom UDM query using the second email, currently the alert pulls both of them which breaks the custom UDM query I have executing later on in the playbook. 

[ylandovskyy · Accepted solution]

In that case, the simplest solution is to use the "last" function.

[d_patel_dj]

Thats worked!

Thanks @ylandovskyy 🙂