https://community.splunk.com/t5/Getting-Data-In/How-to-compute-size-of-array-field-in-JSON-using-spath/m-p/447353#M77801 <P>That is because the arrayField in multivalued , try this:<BR /> | makeresults | eval raw="{\"arrayField\":[{\"a\":\"b\"}, {\"c\":\"d\"}], \"objField\":{\"e\":\"f\"}}" | spath input=raw path=objField | eval objFieldSize = len(objField)| spath input=raw path=arrayField{} output=arrayField | table objFieldSize, objField, arraySize, arrayField<BR /> | mvexpand arrayField<BR /> | eval arraySize=len(arrayField)<BR /> | mvcombine arrayField</P> Sun, 05 May 2019 06:13:04 GMT Sukisen1981 2019-05-05T06:13:04Z https://community.splunk.com/t5/Getting-Data-In/How-to-compute-size-of-array-field-in-JSON-using-spath/m-p/447352#M77800 <P>I want to calculate the raw size of an array field in JSON. <CODE>len()</CODE> command works fine to calculate size of JSON object field, but <CODE>len()</CODE> command doesn't work for array field. Here is the query e.g:</P> <PRE><CODE>| makeresults | eval raw="{\"arrayField\":[{\"a\":\"b\"}, {\"c\":\"d\"}], \"objField\":{\"e\":\"f\"}}" | spath input=raw path=objField | eval objFieldSize = len(objField)| spath input=raw path=arrayField{} output=arrayField | eval arraySize=len(arrayField) | table objFieldSize, objField, arraySize, arrayField </CODE></PRE> <P>It produces output:</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7019iEA4A07BB81CF32E8/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>It shows the correct value for objFieldSize, but arrayFieldSize is empty. Am I missing something..? How can I compute arrayFieldSize corectly?</P> Sun, 05 May 2019 03:19:58 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-compute-size-of-array-field-in-JSON-using-spath/m-p/447352#M77800 relango 2019-05-05T03:19:58Z https://community.splunk.com/t5/Getting-Data-In/How-to-compute-size-of-array-field-in-JSON-using-spath/m-p/447353#M77801 <P>That is because the arrayField in multivalued , try this:<BR /> | makeresults | eval raw="{\"arrayField\":[{\"a\":\"b\"}, {\"c\":\"d\"}], \"objField\":{\"e\":\"f\"}}" | spath input=raw path=objField | eval objFieldSize = len(objField)| spath input=raw path=arrayField{} output=arrayField | table objFieldSize, objField, arraySize, arrayField<BR /> | mvexpand arrayField<BR /> | eval arraySize=len(arrayField)<BR /> | mvcombine arrayField</P> Sun, 05 May 2019 06:13:04 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-compute-size-of-array-field-in-JSON-using-spath/m-p/447353#M77801 Sukisen1981 2019-05-05T06:13:04Z https://community.splunk.com/t5/Getting-Data-In/How-to-compute-size-of-array-field-in-JSON-using-spath/m-p/447354#M77802 <P>@relango try the <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/MultivalueEvalFunctions#mvcount.28MVFIELD.29">mvcount() evaluation function</A>.</P> <PRE><CODE>| eval arraySize=mvcount(arrayField) </CODE></PRE> Sun, 05 May 2019 13:44:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-compute-size-of-array-field-in-JSON-using-spath/m-p/447354#M77802 niketn 2019-05-05T13:44:27Z https://community.splunk.com/t5/Getting-Data-In/How-to-compute-size-of-array-field-in-JSON-using-spath/m-p/447355#M77803 <P>Thanks, Sukisen. The query works but now computed arraySize value is for the only first element in the array and not for the complete array.</P> Mon, 06 May 2019 14:42:59 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-compute-size-of-array-field-in-JSON-using-spath/m-p/447355#M77803 relango 2019-05-06T14:42:59Z https://community.splunk.com/t5/Getting-Data-In/How-to-compute-size-of-array-field-in-JSON-using-spath/m-p/447356#M77804 <P>Using <CODE>mvjoin</CODE> did the trick. Here is the working query for anyone looking for answer.</P> <PRE><CODE>| makeresults | eval raw="{\"arrayField\":[{\"a\":\"b\"}, {\"c\":\"d\"}], \"objField\":{\"e\":\"f\"}}" | spath input=raw path=objField | eval objFieldSize = len(objField)| spath input=raw path=arrayField{} output=arrayField | eval arraySize=len(mvjoin(arrayField,"")) | table objFieldSize, objField, arraySize, arrayField </CODE></PRE> Mon, 06 May 2019 14:48:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-compute-size-of-array-field-in-JSON-using-spath/m-p/447356#M77804 relango 2019-05-06T14:48:27Z https://community.splunk.com/t5/Getting-Data-In/How-to-compute-size-of-array-field-in-JSON-using-spath/m-p/447357#M77805 <P>@relango if you want to count the multi-valued field values and keep the field as multi-valued, you should use <CODE>mvcount()</CODE> instead of mvjoin which makes it is single value field.</P> Mon, 06 May 2019 15:12:07 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-compute-size-of-array-field-in-JSON-using-spath/m-p/447357#M77805 niketn 2019-05-06T15:12:07Z https://community.splunk.com/t5/Getting-Data-In/How-to-compute-size-of-array-field-in-JSON-using-spath/m-p/447358#M77806 <P>@relango - Glad to see you figured this out yourself, i knew a few permutations of the different mv functions will sort this out, upvoted your comment and please accept your own answer as it resolved the issue.<BR /> Many apologies , I was stuck with office work and could not get back to you earlier on this, but then again I did not need to since you figured it out yourself <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Sat, 11 May 2019 08:29:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-compute-size-of-array-field-in-JSON-using-spath/m-p/447358#M77806 Sukisen1981 2019-05-11T08:29:43Z https://community.splunk.com/t5/Getting-Data-In/How-to-compute-size-of-array-field-in-JSON-using-spath/m-p/447359#M77807 <P>Sure, Thanks for your hint which helped me figure it out.</P> Sat, 11 May 2019 20:01:15 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-compute-size-of-array-field-in-JSON-using-spath/m-p/447359#M77807 relango 2019-05-11T20:01:15Z