> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/json_extract_scalar_array.md).

# json\_extract\_scalar\_array

{% hint style="info" %}

### Important

Before using this JSON function, it's important that you understand how Cortex XDR treats a JSON in the Cortex Query Language. This function doesn't have a syntatic sugar format. For more information, see [JSON functions](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/get-started-with-xql/json-functions.md).
{% endhint %}

**Syntax**

```programlisting
json_extract_scalar_array(<json_array_string>, <json_path>)
```

{% hint style="info" %}

### Important

A field in the `<json_path>` that contains characters, such as a dot (.) or colon (:) and should be escaped as it's an invalid JSON path, is currently unsupported.
{% endhint %}

**Description**

The `json_extract_scalar_array()` function accepts a string representing a JSON array, and returns an XQL-native array. This function is equivalent to the [json\_extract\_array](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/json_extract_array.md) except that the final output isn't displayed in double quotes ("..."). To convert a string field to a JSON object, use the [to\_json\_string](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/to_json_string.md) function.

{% hint style="info" %}

### Important

JSON field names are case sensitive, so the key to field pairing must be identical in an XQL query for results to be found. For example, if a field value is `"TIMESTAMP"` and your query is defined to look for "timestamp", no results will be found.
{% endhint %}

**Example**

Extract the first IPV4 address found in the first element of the `agent_interface_map` array. The values of the IPv4 addresses in the array will not contain any double quotes.

```programlisting
dataset = xdr_data 
| fields agent_interface_map as aim 
| alter ipv4 = json_extract_scalar_array(to_json_string(arrayindex(aim, 0)) , "$.ipv4") 
| filter aim != null 
| limit 10
```

Final output with 1 row from the results table. Notice that the IPV4 column doesn't contain any double quotes (`" "`) around the IP address `172.16.15.42`:

| \_TIME                | AIM                                                                   | \_PRODUCT | \_VENDOR | INSERT\_TIMESTAMP      | IPV4         |
| --------------------- | --------------------------------------------------------------------- | --------- | -------- | ---------------------- | ------------ |
| Aug 9th 2023 10:04:39 | `[{"ipv4":["172.16.15.42"], "ipv6": [], "mac": "00:50:56:9f:30:a9"}]` | XDR agent | PANW     | Aug 17th 2023 19:25:48 | 172.16.15.42 |

In contrast, compare the above results to the same query using the `json_extract_array()` function. The final output with the same row from the results table has in the IPV4 column the IP address in double quotes `"172.16.15.42"`.

| \_TIME                | AIM                                                                   | \_PRODUCT | \_VENDOR | INSERT\_TIMESTAMP      | IPV4           |
| --------------------- | --------------------------------------------------------------------- | --------- | -------- | ---------------------- | -------------- |
| Aug 9th 2023 10:04:39 | `[{"ipv4":["172.16.15.42"], "ipv6": [], "mac": "00:50:56:9f:30:a9"}]` | XDR agent | PANW     | Aug 17th 2023 19:25:48 | "172.16.15.42" |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/json_extract_scalar_array.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.