topic Re: Json files Fields counting in Getting Data In

Json files Fields counting

abhayneilam — Fri, 07 Mar 2014 08:27:42 GMT

Hi,
how to find the total number of fields in each event in json file in splunk
thanks in advance !!

Re: Json files Fields counting

martin_mueller — Fri, 07 Mar 2014 12:43:25 GMT

You can count the number of fields in any given Splunk event like this:

your search yielding that event | fieldsummary| stats count

See http://docs.splunk.com/Documentation/Splunk/6.0.2/SearchReference/Fieldsummary for reference.

Re: Json files Fields counting

abhayneilam — Fri, 07 Mar 2014 14:06:09 GMT

I checked that, I have total of 31 fields in my Json File in each event, but after giving this it is coming 48 count , it is also picking up some extra fields from "interesting fields" which is not the part of the JSON file.
The output is coming as 48 but I need "Total Number of Fields per events "

Re: Json files Fields counting

martin_mueller — Fri, 07 Mar 2014 14:14:18 GMT

Those seventeen extra fields probably are these:

date_hour
date_mday
date_minute
date_month
date_second
date_wday
date_year
date_zone
host
index
linecount
punct
source
sourcetype
splunk_server
timeendpos
timestartpos

They're added to each event by default. You could either remove them from your search pipeline using the fields command, or just subtract 17 from your result.

Re: Json files Fields counting

martin_mueller — Fri, 07 Mar 2014 14:17:19 GMT

In case your last sentence meant you were looking for a field calculated for each event, you can do this:

your base search | eval fieldcount = -18 | foreach * [eval fieldcount = fieldcount + 1]

This will deduct itself and the 17 fields listed above from the total count and requires Splunk 6 to work.

Re: Json files Fields counting

abhayneilam — Fri, 07 Mar 2014 14:35:13 GMT

I have splunk 6, lemme work on that, will get back to you soon !!

Re: Json files Fields counting

abhayneilam — Fri, 07 Mar 2014 14:53:52 GMT

Thanks its working !! I have all event with 31 fields so I cant find which event has more or less fields. BTW it is a good one , Appreciated , I am liking it !!

Thanks a lot !!