https://community.splunk.com/t5/Getting-Data-In/Get-count-of-top-level-keys-from-JSON/m-p/522080#M88175 <P>Do you mean "keys" as in, your example, 'level', 'logger_name', 'process', and so on?</P><P>If so, some variant of a search like</P><LI-CODE lang="markup">index=fw | fieldsummary | fields field, count | search count&gt;0 NOT field IN ("date*", "eventtype", "index", "linecount", "punct", "source", "sourcetype", "splunk_server", "splunk_server_group", "tag*", "timeendpos", "timestartpos") | stats count</LI-CODE><P>might do it.&nbsp; You'll have to remove the "stats count" at the end to double-check that all the Splunk built-in fields are removed in that `NOT field IN ....` part of the search.</P><P>&nbsp;</P> Tue, 29 Sep 2020 18:27:21 GMT Richfez 2020-09-29T18:27:21Z https://community.splunk.com/t5/Getting-Data-In/Get-count-of-top-level-keys-from-JSON/m-p/521594#M88124 <P>my Splunk logs looks like below. Total keys could change based on use case. I need to get exact number of keys from below data and then what is the max key count among those. Please guide me here.</P><LI-CODE lang="javascript">{ level: INFO logger_name: com.123.logging process: NA requestId: 1234567 attribute: email criteria: value path: aa.bb.cc service_name: SERVICE_NAME thread_name: h1234567 timestamp: 2020-09-26T07:33:53.451Z }</LI-CODE><P>&nbsp;</P> Sat, 26 Sep 2020 07:45:51 GMT https://community.splunk.com/t5/Getting-Data-In/Get-count-of-top-level-keys-from-JSON/m-p/521594#M88124 Pramodkuber 2020-09-26T07:45:51Z https://community.splunk.com/t5/Getting-Data-In/Get-count-of-top-level-keys-from-JSON/m-p/522080#M88175 <P>Do you mean "keys" as in, your example, 'level', 'logger_name', 'process', and so on?</P><P>If so, some variant of a search like</P><LI-CODE lang="markup">index=fw | fieldsummary | fields field, count | search count&gt;0 NOT field IN ("date*", "eventtype", "index", "linecount", "punct", "source", "sourcetype", "splunk_server", "splunk_server_group", "tag*", "timeendpos", "timestartpos") | stats count</LI-CODE><P>might do it.&nbsp; You'll have to remove the "stats count" at the end to double-check that all the Splunk built-in fields are removed in that `NOT field IN ....` part of the search.</P><P>&nbsp;</P> Tue, 29 Sep 2020 18:27:21 GMT https://community.splunk.com/t5/Getting-Data-In/Get-count-of-top-level-keys-from-JSON/m-p/522080#M88175 Richfez 2020-09-29T18:27:21Z