https://community.splunk.com/t5/Getting-Data-In/How-to-dedup-a-field-inside-JSON-arrays/m-p/136647#M28148 <P>Hi guys,</P> <P>I'm working on some formulas to show percentages, right now trying to count % vendors affected by vulnerabilities. The data I am working with is a single JSON file, broken down into each Vulnerability ID. Problem is, if I try to dedup a Vendor that is affected by a particular vulnerability (which are listed as vendor, product, version, inside separate JSON sub-arrays within the vulnerability ID), it still counts the multiple versions, even though I:</P> <P>index = jsonvuln | dedup id Vendor | top 100 Vendor</P> <P>returns &gt; 100% for Vendors like Apple and Adobe, which show up multiple times in each Vulnerability ID. So like 236.76% for Adobe.The dedup doesn't seem to work for the array within the event. Is there a command I can use to dedup these Vendors so Splunk only counts it once?</P> Thu, 23 Jul 2015 18:35:38 GMT jravida 2015-07-23T18:35:38Z https://community.splunk.com/t5/Getting-Data-In/How-to-dedup-a-field-inside-JSON-arrays/m-p/136647#M28148 <P>Hi guys,</P> <P>I'm working on some formulas to show percentages, right now trying to count % vendors affected by vulnerabilities. The data I am working with is a single JSON file, broken down into each Vulnerability ID. Problem is, if I try to dedup a Vendor that is affected by a particular vulnerability (which are listed as vendor, product, version, inside separate JSON sub-arrays within the vulnerability ID), it still counts the multiple versions, even though I:</P> <P>index = jsonvuln | dedup id Vendor | top 100 Vendor</P> <P>returns &gt; 100% for Vendors like Apple and Adobe, which show up multiple times in each Vulnerability ID. So like 236.76% for Adobe.The dedup doesn't seem to work for the array within the event. Is there a command I can use to dedup these Vendors so Splunk only counts it once?</P> Thu, 23 Jul 2015 18:35:38 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-dedup-a-field-inside-JSON-arrays/m-p/136647#M28148 jravida 2015-07-23T18:35:38Z https://community.splunk.com/t5/Getting-Data-In/How-to-dedup-a-field-inside-JSON-arrays/m-p/136648#M28149 <P>Figured it out.</P> <P>I have to use mvexpand on the Vendor field. Then dedup Vendor and ID fields. So simple!</P> Thu, 23 Jul 2015 18:42:58 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-dedup-a-field-inside-JSON-arrays/m-p/136648#M28149 jravida 2015-07-23T18:42:58Z