asked on

Change JSON field using PowerShell Core

I have following JSON file and i need update the displayName to contain either QA or Production :

{
    "analytics": [
      {
        "kind": "Scheduled",
        "displayName": "RO-0024-DEV GPO Scheduled Task",
        "description": "test",
        "severity": "Low",
        "enabled": true,
        "query":"SecurityEvent | where EventID == \"5145\"  | where AccountType == \"User\"",
        "queryFrequency": "5H",
        "queryPeriod": "6H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 5,
        "suppressionDuration": "6H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence",
          "LateralMovement",
          "Collection"
        ],
        "PlayBookName": "Test447"

      }
    ]  
}

Open in new window

i am running a powershell script via Azure Devops build agent and depending on the Tennant, i want to change the DisplayName that contains Dev to QA or Prod.

i have tried the following for testing however it fails:

$rules = Get-Content -Raw -Path .\TestJson.json | ConvertFrom-Json
$rules.analytics.displayname = "test"

Open in new window

i get the following error:

The property 'displayname' cannot be found on this object. Verify that the property exists and can be set.
At line:1 char:1
+ $rules.analytics.displayname = "test"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : PropertyAssignmentException

Open in new window

Thank you in advance.

Regards,
Kelly

ASKER CERTIFIED SOLUTION

oBdA

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Kelly Garcia

ASKER

thank you every so much !

Kelly Garcia

ASKER

i have one more issue now, i need to change the displayname and i've just attempted the following:

(($rules.analytics[0].displayName).Split(" ").split("-")[2]).replace("$_", "Qa")

Open in new window

however i get the following error:

Exception calling "Replace" with "2" argument(s): "String cannot be of zero length.
Parameter name: oldValue"
At line:1 char:1
+ (($rules.analytics[0].displayName).Split(" ").split("-")[2]).replace( ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : ArgumentException

also is there better way of writing this code? please let me know if i should raise this as a seperate question?

thanks again,
Kelly

oBdA

Use a Regex:

$type = 'Qa'
$rules.analytics[0].displayName = $rules.analytics[0].displayName -replace '^(.*?-.*?-)(.*?)(\s.*)$', "`$1$($type)`$3"

Open in new window