topic Re: How to extract count of specific event from nested JSON? in Splunk Search

How to extract count of specific event from nested JSON?

chtmai — Tue, 18 Aug 2020 23:52:47 GMT

I have this data coming in every minute to monitor application performance:

{ "events": [ { "appId": "mock-app", "eventType": "WorkflowRequestFailedCount", "failureType": "wf.execution.error", "metricType": "COUNTER", "requestType": "WORKFLOW", "throughput": 15, "workflowId": "create" }, { "appId": "mock-app", "eventType": "WorkflowRequestProcessedCount", "metricType": "COUNTER", "requestType": "WORKFLOW", "throughput": 0 }, { "appId": "mock-app", "eventType": "WorkflowRequestReceivedCount", "metricType": "COUNTER", "requestType": "WORKFLOW", "throughput": 20, "workflowId": "create" } ] }

I need a query (to set up an alert) that identifies when throughput is GREATER than 0 for throughput nested with eventType = WorkflowRequestFailedCount. I can't figure out how to isolate the throughput count between different eventType items when they are both nested within the same events object as shown above.

For the JSON shown above, the correct query should trigger an alert because the throughput for WorkflowRequestFailedCount is 15 (greater than 0).

Appreciate the help.

Re: How to extract count of specific event from nested JSON?

to4kawa — Tue, 18 Aug 2020 23:24:42 GMT

your sample is not valid json.
Splunk can't extract invalid json.
We can't create a solution with the wrong sample.

Re: How to extract count of specific event from nested JSON?

chtmai — Tue, 18 Aug 2020 23:33:49 GMT

@to4kawa Updated! Does this help?

Re: How to extract count of specific event from nested JSON?

to4kawa — Tue, 18 Aug 2020 23:49:39 GMT

this is valid JSON. your JSON is not valid.

Re: How to extract count of specific event from nested JSON?

chtmai — Tue, 18 Aug 2020 23:51:51 GMT

@to4kawa Sorry! I was using the highlighted syntax mode in Splunk. Thanks for correcting that.

Re: How to extract count of specific event from nested JSON?

to4kawa — Tue, 18 Aug 2020 23:55:05 GMT

| spath events{} output=events
| mvexpand events
| spath input=events
| fields - events* _raw
| search throughput > 0 AND eventType = WorkflowRequestFailedCount
| table *