topic Re: mvzip json array of values in one event in Splunk Search

mvzip json array of values in one event

exocore123 — Fri, 30 Jun 2017 21:25:30 GMT

[  
   {  
      "sym":"ee",
      "code":2E1,
   },
   {  
      "sym":"ie",
      "code":2E2,
   }
]

I have a field call errorData, when I use spath to access the json and do stats and mvzip(sym,code) function, it splits these events into two different events (but it is still not really what I want). How can I keep it into one event with the contents aggregated. Sometimes the array also only has 1 element, so it should be viable for that situation too

sym                     code                       count
ee,ie                 2E1,2E2                       1
ee                      2E2                         1

And I do not want the json with single element array to over-count, I mean mistakenly count matching in the multiple elements json.

Re: mvzip json array of values in one event

somesoni2 — Mon, 03 Jul 2017 21:11:28 GMT

Can you provide your current full search that you're using?

Re: mvzip json array of values in one event

exocore123 — Wed, 05 Jul 2017 01:06:53 GMT

index=index | spath input=errorMsg path={}.sym output=sym | spath input=errorMsg path={}.code output=code | stats count by sym, code

Re: mvzip json array of values in one event

exocore123 — Wed, 05 Jul 2017 01:07:46 GMT

Or eval msg=mvzip(sym, code) | stats count by msg would get me two events listed instead of 4 like above

Re: mvzip json array of values in one event

somesoni2 — Wed, 05 Jul 2017 16:51:18 GMT

Try this

index=index | spath input=errorMsg path={}.sym output=sym | spath input=errorMsg path={}.code output=code | nomv sym | nomv code | stats count by sym code

Re: mvzip json array of values in one event

exocore123 — Wed, 05 Jul 2017 19:58:56 GMT

Wow... that was so much easier than I thought, is there a way I can introduce a comma within the space? Using rex or makedelim or join maybe?

Re: mvzip json array of values in one event

somesoni2 — Wed, 05 Jul 2017 21:44:08 GMT

You can do like this (assuming the value of sym and code do not contain spaces on their own.

above search
| eval sym=replace(sym," ",", ") | eval code=replace(code," ",", ")