topic Re: Help extracting totalCount out of nested JSON in Splunk Search

Help extracting totalCount out of nested JSON

bhavya49 — Thu, 05 Dec 2019 23:09:09 GMT

{ [-]
   detailMap: { [-]
     critical: false
     result: 0
     totalCnt: 5
     txnCountWithIgnoredIRC: 0
     warning: false
   }
   id: 60300000000
   name: EBALL
}

I'm trying to extract totalCount out of the nested Json. I'm trying the below search to extract it:

index="pas" source="agent.log" | spath output=myCount path=detailMap{}.totalCnt | table myCount

When I'm running this search, myCount column is blank.
Please let me know how to improvise this search.

Re: Help extracting totalCount out of nested JSON

vnravikumar — Fri, 06 Dec 2019 02:53:08 GMT

Try this

| makeresults 
| eval temp="{
  \"detailMap\": {
    \"critical\": false,
    \"result\": 0,
    \"totalCnt\": 5,
    \"txnCountWithIgnoredIRC\": 0,
    \"warning\": false
  },
  \"id\": 60300000000,
  \"name\": \"EBALL\"
        }" 
| spath input=temp output=totalCnt path=detailMap{}.totalCnt | table totalCnt

Re: Help extracting totalCount out of nested JSON

to4kawa — Wed, 01 Jan 2020 23:50:25 GMT

| makeresults
| eval _raw = "{ 
    \"detailMap\": { 
      \"critical\": \"false\",
      \"result\": \"0\",
      \"totalCnt\": \"5\",
      \"txnCountWithIgnoredIRC\": \"0\",
      \"warning\": \"false\"
    },
    \"id\": \"60300000000\",
    \"name\": \"EBALL\"
 }"
| spath

From this results,

index="pas" source="agent.log" 
| spath output=myCount path=detailMap.totalCnt 
| table myCount

It looks like the field name is different.