How to count the number of event based on JSON field structure/keys in Splunk

samgol — Wed, 03 Feb 2021 18:20:24 GMT

I want to count the number of occurrence of a specific JSON structure. For example in my event there is a field called data which its value is JSON . but this field can have a variety of structures. like:

data = {a: "b"}
data= {d: "x", h: "e"}

now I want to know how many event has data with each JSON structure and I don't care about values only keys are matter. So I want to count JSON that has similar keys.

Re: How to count the number of event based on JSON field structure/keys in Splunk

tscroggins — Sun, 21 Feb 2021 06:38:39 GMT

@samgol

You can get an approximate count by JSON key schema using something like this:

Note that two schemas with the same field counts will be combined into a single set.

Another possibility is removing values and normalizing them to "" in data before grouping:

| eval data=replace(data, "\" ?: ?(?:\"(?:\\\"|.*?)\"|[-\d\.eE]+)", "\":\"\"")
| stats count by data

{"a": "b"} => {"a":""}
{"d": "x", "h": "e"} => {"d":"", "h":""}

data count
{"a":""} 1
{"d":"", "h":""} 1

topic Re: How to count the number of event based on JSON field structure/keys in Splunk in Splunk Search

How to count the number of event based on JSON field structure/keys in Splunk

Re: How to count the number of event based on JSON field structure/keys in Splunk