https://community.splunk.com/t5/Getting-Data-In/How-to-aggregate-results-by-elements-in-the-array-and-sort-them/m-p/752792#M119507 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/312487">@karol</a>&nbsp;</P><P>You can use spath and mvexpand on your field.</P><LI-CODE lang="markup">| spath input=attributes | mvexpand attributes | eval true_count=if(attributes="true", 1, 0), false_count=if(attributes="false", 1, 0) | stats sum(true_count) as true_count sum(false_count) as false_count by name | eval percentage=round((true_count / (true_count + false_count)) * 100, 2) | sort - percentage </LI-CODE><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="demo12.JPG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/40185iC29AD0DDB95C73F6/image-size/large?v=v2&amp;px=999" role="button" title="demo12.JPG" alt="demo12.JPG" /></span></P><P>Regards,<BR />Prewin<BR />If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!</P> Mon, 08 Sep 2025 04:33:57 GMT PrewinThomas 2025-09-08T04:33:57Z https://community.splunk.com/t5/Getting-Data-In/How-to-aggregate-results-by-elements-in-the-array-and-sort-them/m-p/752790#M119506 <P>I got my data stream in a following format:</P><LI-CODE lang="javascript">[ { "name": "event 1" "attributes": [false, true, true], }, { "name": "event 2" "attributes": [false, false, true], } ]</LI-CODE><P>I want to output them sorting by a ratio of `true` to `false` values in the array:</P><LI-CODE lang="markup">name| true count | false count | percentage event 1 | 2 | 1 | 66.67% event 2 | 1 | 2 | 33.33%</LI-CODE><P>&nbsp;</P> Mon, 08 Sep 2025 04:07:04 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-aggregate-results-by-elements-in-the-array-and-sort-them/m-p/752790#M119506 karol 2025-09-08T04:07:04Z https://community.splunk.com/t5/Getting-Data-In/How-to-aggregate-results-by-elements-in-the-array-and-sort-them/m-p/752792#M119507 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/312487">@karol</a>&nbsp;</P><P>You can use spath and mvexpand on your field.</P><LI-CODE lang="markup">| spath input=attributes | mvexpand attributes | eval true_count=if(attributes="true", 1, 0), false_count=if(attributes="false", 1, 0) | stats sum(true_count) as true_count sum(false_count) as false_count by name | eval percentage=round((true_count / (true_count + false_count)) * 100, 2) | sort - percentage </LI-CODE><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="demo12.JPG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/40185iC29AD0DDB95C73F6/image-size/large?v=v2&amp;px=999" role="button" title="demo12.JPG" alt="demo12.JPG" /></span></P><P>Regards,<BR />Prewin<BR />If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!</P> Mon, 08 Sep 2025 04:33:57 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-aggregate-results-by-elements-in-the-array-and-sort-them/m-p/752792#M119507 PrewinThomas 2025-09-08T04:33:57Z