https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-count-for-this-JSON-value-pair/m-p/493834#M84355 <P>I want to get the count for the key value pair and make it in a table. Could anyone please help me on this.</P> <P>My sample data looks like below:<BR /> I want to take the count of Name alone. </P> <P>School {Name : "abc", Number: "123",Age:"" }</P> Tue, 08 Oct 2019 08:42:32 GMT muthu3006 2019-10-08T08:42:32Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-count-for-this-JSON-value-pair/m-p/493834#M84355 <P>I want to get the count for the key value pair and make it in a table. Could anyone please help me on this.</P> <P>My sample data looks like below:<BR /> I want to take the count of Name alone. </P> <P>School {Name : "abc", Number: "123",Age:"" }</P> Tue, 08 Oct 2019 08:42:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-count-for-this-JSON-value-pair/m-p/493834#M84355 muthu3006 2019-10-08T08:42:32Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-count-for-this-JSON-value-pair/m-p/493835#M84356 <P>Hello @muthu3006,<BR /> I am not quite sure I understood what you seek, but here is a sample of request that will let you elaborate on your particular case.</P> <PRE><CODE>|makeresults|eval _raw="{\"School\":[{\"Name\" : \"abc\", \"Number\": 123,\"Age\":\"\"},{\"Name\" : \"def\", \"Number\": 456,\"Age\":\"\"},{\"Name\" : \"ghi\", \"Number\": 789,\"Age\":\"\"}]}"|spath |rename School{}.Name as names|eval nb=mvcount(names) </CODE></PRE> Tue, 08 Oct 2019 14:59:14 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-count-for-this-JSON-value-pair/m-p/493835#M84356 poete 2019-10-08T14:59:14Z