https://community.splunk.com/t5/Getting-Data-In/trouble-with-extracting-data-from-JSON-event/m-p/502448#M85596 <P>Hi, I am storing the events containing subscribers per subscription topics.</P> <P>The events look like this:</P> <PRE><CODE>{"type":"subscriptions","details":{"topic":"topic1","subscribers":["192.168.74.25","10.132.45.54"]}} ... {"type":"subscriptions","details":{"topic":"topic2","subscribers":["192.168.74.26","10.132.45.54"]}} ... </CODE></PRE> <P>I want to count all subscriptions per subscribers and plot it over time.</P> <P>Until now I managed to extract the list of subscribers using this Splunk query:</P> <PRE><CODE>source="mysource" | chart values(details.subscribers{}) as subscribers </CODE></PRE> <P>I guess I should now use it in subquery ?</P> <P>Any help would be appreciated!</P> <P>Thanks,<BR /> L.</P> Wed, 16 Oct 2019 13:53:06 GMT lwiechec 2019-10-16T13:53:06Z https://community.splunk.com/t5/Getting-Data-In/trouble-with-extracting-data-from-JSON-event/m-p/502448#M85596 <P>Hi, I am storing the events containing subscribers per subscription topics.</P> <P>The events look like this:</P> <PRE><CODE>{"type":"subscriptions","details":{"topic":"topic1","subscribers":["192.168.74.25","10.132.45.54"]}} ... {"type":"subscriptions","details":{"topic":"topic2","subscribers":["192.168.74.26","10.132.45.54"]}} ... </CODE></PRE> <P>I want to count all subscriptions per subscribers and plot it over time.</P> <P>Until now I managed to extract the list of subscribers using this Splunk query:</P> <PRE><CODE>source="mysource" | chart values(details.subscribers{}) as subscribers </CODE></PRE> <P>I guess I should now use it in subquery ?</P> <P>Any help would be appreciated!</P> <P>Thanks,<BR /> L.</P> Wed, 16 Oct 2019 13:53:06 GMT https://community.splunk.com/t5/Getting-Data-In/trouble-with-extracting-data-from-JSON-event/m-p/502448#M85596 lwiechec 2019-10-16T13:53:06Z https://community.splunk.com/t5/Getting-Data-In/trouble-with-extracting-data-from-JSON-event/m-p/502449#M85597 <P>This would get you the number of events, which I think is what you mean by subscriptions, per subscriber over time. </P> <PRE><CODE>source="mysource" | eval rename details.subscribers{} as subscribers | mvexpand subscribers | timechart count by subscribers </CODE></PRE> Wed, 16 Oct 2019 19:23:22 GMT https://community.splunk.com/t5/Getting-Data-In/trouble-with-extracting-data-from-JSON-event/m-p/502449#M85597 kmaron 2019-10-16T19:23:22Z