topic Re: JSON data, unexpected value count in All Apps and Add-ons

JSON data, unexpected value count

phanikumarcs — Thu, 08 Feb 2024 21:38:03 GMT

Hi,

When i want to extract the fields from JSON (below) destination,messages, inflightMessages.

This the one of the latest event:

{ "analytics": [ { "destination": "billing.events.prod", "messages": 0, "inflightMessages": 0 }, { "destination": "billing.events.dev", "messages": 0, "inflightMessages": 0 }, { "destination": "hub.values.prod", "messages": 0, "inflightMessages": 0 }, { "destination": "hub.fifo-prod", "messages": 0, "inflightMessages": 0 } ] }

This is the spl i am using:

index=myindex sourcetype=mysourcetype

| spath input=_raw

| table analytics{}.destination, analytics{}.messages, analytics{}.inflightMessages

Where i am getting in the intrested fields

"analytics{}.destination" for this when i move curser to see values and count associated, for each value showing count 2, when you search for one event.

Why this is happening what is the issue? This data generally mulesoftmq.

Re: JSON data, unexpected value count

danielcj — Thu, 08 Feb 2024 22:54:43 GMT

Hello @phanikumarcs ,

The spath command is duplicating the values of this event. Please try the following not using the spath command:

index=myindex sourcetype=mysourcetype | table analytics{}.destination, analytics{}.messages, analytics{}.inflightMessages

Thanks.

Re: JSON data, unexpected value count

phanikumarcs — Fri, 09 Feb 2024 09:47:20 GMT

If you see what every i am trying its getting two same values

Re: JSON data, unexpected value count

ITWhisperer — Fri, 09 Feb 2024 13:23:41 GMT

It looks like you have found 2 events in your search not 1, but your screenshot doesn't show how many events were returned. You could also look in your search log to see what is happening.

Re: JSON data, unexpected value count

phanikumarcs — Fri, 09 Feb 2024 15:02:53 GMT

@danielcj @ITWhisperer
In this instance, I am utilizing the SPL. The most recent event I am obtaining is from a table, where I encounter repeated values in the 'destination field which is 2.'

index=foo sourcetype="foo" source="foo" | spath input=_raw output=analytics path="analytics{}" | rename "analytics{}.destination" as destination, "analytics{}.messages" as messages, "analytics{}.inflightMessages" as inflightMessages | sort 0 -_time | eventstats max(_time) as latestTime | where _time = latestTime | table destination, messages, inflightMessages

Re: JSON data, unexpected value count

ITWhisperer — Fri, 09 Feb 2024 14:21:53 GMT

There is nothing in this search that ensures you only have one event - you could have two events with exactly the same _time value - try something like this

| sort 0 -_time | head 1

Re: JSON data, unexpected value count

phanikumarcs — Fri, 09 Feb 2024 15:04:16 GMT

i tried this as well earlier, may be the issue with MQ events.

Re: JSON data, unexpected value count

ITWhisperer — Fri, 09 Feb 2024 15:10:31 GMT

Not sure where MQ events come into it. When you tried with sort and head 1, what did you get?

Re: JSON data, unexpected value count

phanikumarcs — Fri, 09 Feb 2024 15:19:31 GMT

@ITWhisperer
in the events only 1 event getting, when you see in statistics getting same 2 values under destination in table.

Re: JSON data, unexpected value count

ITWhisperer — Fri, 09 Feb 2024 15:34:39 GMT

So the data is duplicated in the raw event?