https://community.splunk.com/t5/Splunk-Search/JSON-Field-Extraction-names-with-curly-brackets/m-p/366467#M108102 <P>Thanks @DalJeanis.</P> <P>I tried, but it doesn't give any results, and even if it worked, given the case of a more complex JSON structure the amount of different names for the same node will be more than 4, whats makes this approach not appropiate for this situation.</P> Fri, 06 Oct 2017 12:42:10 GMT dmonsag 2017-10-06T12:42:10Z https://community.splunk.com/t5/Splunk-Search/JSON-Field-Extraction-names-with-curly-brackets/m-p/366464#M108099 <P>Hello<BR /> I'm currently searching over a collection of events that contains some JSON structure, when applying SPATH over the field contaning the JSON, the resulting fields for a specific node of the JSON structure may vary according to the arrays on the message. I need to do some aritmetic operations over this particular node in order to sum all the values from all the events. These are the resulting fields when using SPATH:<BR /> agreementsGroup.agreements.agreementParticipants.proportionalClaimAmount<BR /> agreementsGroup.agreements.agreementParticipants{}.proportionalClaimAmount<BR /> agreementsGroup.agreements{}.agreementParticipants{}.proportionalClaimAmount<BR /> agreementsGroup{}.agreements.agreementParticipants{}.proportionalClaimAmount</P> <P>As you can see they all have different names but refer to the same data I need to sum. Here is an example of my search and the respective result:</P> <PRE><CODE>index="idx_cuadre_core_gw" sourcetype="rbt_cuadre_gw_src_type" | spath input=msg_body | stats sum("agreementsGroup.agreements.agreementParticipants{}.proportionalClaimAmount") by "referenceIdSAP" "policy.currencyCode" | rename "referenceIdSAP" as ID_SAP "policy.currencyCode" as MONEDA sum("agreementsGroup.agreements.agreementParticipants{}.proportionalClaimAmount") as CLAIM_AMOUNT </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/3580iC44B96578147DE0B/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>How can I treat these "different" named fields as one in order to sum and display the table without missing any data?</P> Wed, 04 Oct 2017 20:41:59 GMT https://community.splunk.com/t5/Splunk-Search/JSON-Field-Extraction-names-with-curly-brackets/m-p/366464#M108099 dmonsag 2017-10-04T20:41:59Z https://community.splunk.com/t5/Splunk-Search/JSON-Field-Extraction-names-with-curly-brackets/m-p/366465#M108100 <P>Have you tried...</P> <PRE><CODE>| eval proportionalClaimAmount =coalesce(agreementsGroup.agreements.agreementParticipants.proportionalClaimAmount, agreementsGroup.agreements.agreementParticipants{}.proportionalClaimAmount, agreementsGroup.agreements{}.agreementParticipants{}.proportionalClaimAmount, agreementsGroup{}.agreements.agreementParticipants{}.proportionalClaimAmount) </CODE></PRE> Wed, 04 Oct 2017 20:57:54 GMT https://community.splunk.com/t5/Splunk-Search/JSON-Field-Extraction-names-with-curly-brackets/m-p/366465#M108100 DalJeanis 2017-10-04T20:57:54Z https://community.splunk.com/t5/Splunk-Search/JSON-Field-Extraction-names-with-curly-brackets/m-p/366466#M108101 <P>Do every event, after spath, contain all 4 field or just one of them? If it's later, @Daljeanis's answer can create a common field name from all those different named field which you can use in your stats.</P> Wed, 04 Oct 2017 21:27:34 GMT https://community.splunk.com/t5/Splunk-Search/JSON-Field-Extraction-names-with-curly-brackets/m-p/366466#M108101 somesoni2 2017-10-04T21:27:34Z https://community.splunk.com/t5/Splunk-Search/JSON-Field-Extraction-names-with-curly-brackets/m-p/366467#M108102 <P>Thanks @DalJeanis.</P> <P>I tried, but it doesn't give any results, and even if it worked, given the case of a more complex JSON structure the amount of different names for the same node will be more than 4, whats makes this approach not appropiate for this situation.</P> Fri, 06 Oct 2017 12:42:10 GMT https://community.splunk.com/t5/Splunk-Search/JSON-Field-Extraction-names-with-curly-brackets/m-p/366467#M108102 dmonsag 2017-10-06T12:42:10Z https://community.splunk.com/t5/Splunk-Search/JSON-Field-Extraction-names-with-curly-brackets/m-p/366468#M108103 <P>After some tests I finally, use this kind of workaround which allows me to extract the values of all the nodes based on a regular expression. Not the best solution anyway but at least I was able to generate my report. If anybody comes up with a better solution I'll be glad to hear about it.</P> <PRE><CODE>index="idx_cuadre_core_gw" sourcetype="rbt_cuadre_gw_src_type" | search "cop" "proportionalClaimAmount" | rex field=_raw max_match=0 "\"proportionalClaimAmount\":\"(?&lt;proportionalClaimAmount&gt;.*?)\"" | stats sum(proportionalClaimAmount) </CODE></PRE> Fri, 06 Oct 2017 12:46:44 GMT https://community.splunk.com/t5/Splunk-Search/JSON-Field-Extraction-names-with-curly-brackets/m-p/366468#M108103 dmonsag 2017-10-06T12:46:44Z