<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: how to sum the machine OS in a JSON file in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/how-to-sum-the-machine-OS-in-a-JSON-file/m-p/499649#M85162</link>
    <description>&lt;PRE&gt;&lt;CODE&gt;| makeresults 
| eval _raw="{\"clusterA\": ubuntu,
\"clusterA\": ubuntu,
\"clusterA\": rhel5,
\"clusterA\": sles11,
\"clusterB\": sles11,
\"clusterB\": sles11,
\"clusterB\": ubuntu,
\"clusterC\": centos,
\"clusterC\": ubuntu}"
| rex mode=sed "s/: (\w+)/: \"\1\"/g"
| spath
| foreach cluster* [ eval &amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt; = mvjoin('&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;' , ",")]
| untable _time cluster OS
| eval OS = split(OS,",")
| mvexpand OS
| stats count by OS cluster
| sort cluster
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Sat, 16 May 2020 05:05:31 GMT</pubDate>
    <dc:creator>to4kawa</dc:creator>
    <dc:date>2020-05-16T05:05:31Z</dc:date>
    <item>
      <title>how to sum the machine OS in a JSON file</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/how-to-sum-the-machine-OS-in-a-JSON-file/m-p/499648#M85161</link>
      <description>&lt;P&gt;Hi Guys,&lt;/P&gt;

&lt;P&gt;I have a JSON file for OS type in some cluster like below:&lt;/P&gt;

&lt;P&gt;{&lt;BR /&gt;
 "clusterA": ubuntu,&lt;BR /&gt;
 "clusterA": ubuntu,&lt;BR /&gt;
 "clusterA": rhel5,&lt;BR /&gt;
 "clusterA": sles11,&lt;BR /&gt;
 "clusterB": sles11,&lt;BR /&gt;
 "clusterB": sles11,&lt;BR /&gt;
 "clusterB": ubuntu,&lt;BR /&gt;
 "clusterC": centos,&lt;BR /&gt;
 "clusterC": ubuntu&lt;BR /&gt;
...&lt;BR /&gt;
}&lt;/P&gt;

&lt;P&gt;I'd like sum the OS type for each cluster, like in above sample, 2 ubuntu in clusterA, 1 rhel5 in clusterA etc.&lt;BR /&gt;
Would you please kindly help out?&lt;/P&gt;

&lt;P&gt;Thank you!&lt;/P&gt;</description>
      <pubDate>Fri, 15 May 2020 13:12:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/how-to-sum-the-machine-OS-in-a-JSON-file/m-p/499648#M85161</guid>
      <dc:creator>garumaru</dc:creator>
      <dc:date>2020-05-15T13:12:51Z</dc:date>
    </item>
    <item>
      <title>Re: how to sum the machine OS in a JSON file</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/how-to-sum-the-machine-OS-in-a-JSON-file/m-p/499649#M85162</link>
      <description>&lt;PRE&gt;&lt;CODE&gt;| makeresults 
| eval _raw="{\"clusterA\": ubuntu,
\"clusterA\": ubuntu,
\"clusterA\": rhel5,
\"clusterA\": sles11,
\"clusterB\": sles11,
\"clusterB\": sles11,
\"clusterB\": ubuntu,
\"clusterC\": centos,
\"clusterC\": ubuntu}"
| rex mode=sed "s/: (\w+)/: \"\1\"/g"
| spath
| foreach cluster* [ eval &amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt; = mvjoin('&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;' , ",")]
| untable _time cluster OS
| eval OS = split(OS,",")
| mvexpand OS
| stats count by OS cluster
| sort cluster
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Sat, 16 May 2020 05:05:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/how-to-sum-the-machine-OS-in-a-JSON-file/m-p/499649#M85162</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2020-05-16T05:05:31Z</dc:date>
    </item>
    <item>
      <title>Re: how to sum the machine OS in a JSON file</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/how-to-sum-the-machine-OS-in-a-JSON-file/m-p/499650#M85163</link>
      <description>&lt;P&gt;Hi&lt;/P&gt;

&lt;P&gt;Check this&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults 
| eval json="{\"clusterA\": ubuntu,
 \"clusterA\": ubuntu,
 \"clusterA\": rhel5,
 \"clusterA\": sles11,
 \"clusterB\": sles11,
 \"clusterB\": sles11,
 \"clusterB\": ubuntu,
 \"clusterC\": centos,
 \"clusterC\": ubuntu}" 
| eval json=replace(json,"\"|{|\s|}","") 
| makemv delim="," json 
| mvexpand json 
| eval temp=split(json,":"),cluster=mvindex(temp,0),os=mvindex(temp,1) 
| stats count by cluster,os
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Sat, 16 May 2020 05:59:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/how-to-sum-the-machine-OS-in-a-JSON-file/m-p/499650#M85163</guid>
      <dc:creator>vnravikumar</dc:creator>
      <dc:date>2020-05-16T05:59:10Z</dc:date>
    </item>
  </channel>
</rss>

