topic How to do a stats count by on only some array elements? in Splunk Enterprise

How to do a stats count by on only some array elements?

thomas_nguyen — Fri, 27 Jan 2023 19:37:34 GMT

Hey everyone. I am trying to do a stats count by items{}.description, items{}.price but I'd like to filter out some of the items. In this example, I'd like to include "description one" and "description two", but not "description three". In the real situation there is many more that I'd like to include and to exclude.

Is this possible?

"time": "01:01:01", "items": [ { "description": "description one", "price": "$220" }, { "description": "description two", "price": "$10" }, { "description": "description three", "price": "$50" } ]

Re: How to do a stats count by on only some array elements?

ITWhisperer — Sat, 28 Jan 2023 09:00:57 GMT

Try extracting the items from the collection with spath, then mvexpand the multi-value field, then extract the next level down, and filter the values you want to keep

| spath items{} output=items | mvexpand items | spath input=items | where description IN ("description one", "description two") | stats count by description, price

Re: How to do a stats count by on only some array elements?

thomas_nguyen — Fri, 27 Jan 2023 23:39:06 GMT

@ITWhisperer thank you so much. That worked. I did have to tweak it slightly but I was able to get what I was looking for.

| spath output=items path=items{} | mvexpand items | spath input=items | where description IN ("description one", "description two") | stats count by description, price

Re: How to do a stats count by on only some array elements?

ITWhisperer — Sat, 28 Jan 2023 09:02:33 GMT

Thanks - I updated the solution (a typo on my part) 😀