https://community.splunk.com/t5/Splunk-Search/Filter-events-by-length-of-json-field/m-p/552906#M156948 <P>I thought this was the same as my struggle with dereferencing JSON paths but it is not. &nbsp;This has to do with using len() in <EM>where</EM> command with multivalue. &nbsp;Here's a working filter:</P><LI-CODE lang="markup">|where isnotnull(len('x.y.z{}.field') &gt; 20) |stats count by x.y.z{}.field</LI-CODE><P>Note, however, that count by an array field is not going to work too well if all you care are the values in the array whose length is greater than 20. &nbsp;In that case you'll have to apply the filter again after stats, like</P><LI-CODE lang="markup">|where isnotnull(len('x.y.z{}.field') &gt; 20) |stats count by x.y.z{}.field |where isnotnull(len('x.y.z{}.field') &gt; 20)</LI-CODE><P>&nbsp;</P> Tue, 25 May 2021 08:18:18 GMT yuanliu 2021-05-25T08:18:18Z https://community.splunk.com/t5/Splunk-Search/Filter-events-by-length-of-json-field/m-p/552813#M156918 <P>I'm trying put together a query to find some outlier events with very long values within a complex structure.</P><P>&nbsp;</P><LI-CODE lang="markup">index=myindex sourcetype=jsonfile | where len('x.y.z{}.field') &gt; 20 | stats count by x.y.z{}.field</LI-CODE><P>&nbsp;</P><P>This is my first stab at how to do this, but it doesn't return any values, even though I know they are there.</P> Mon, 24 May 2021 17:09:34 GMT https://community.splunk.com/t5/Splunk-Search/Filter-events-by-length-of-json-field/m-p/552813#M156918 ShagVT 2021-05-24T17:09:34Z https://community.splunk.com/t5/Splunk-Search/Filter-events-by-length-of-json-field/m-p/552906#M156948 <P>I thought this was the same as my struggle with dereferencing JSON paths but it is not. &nbsp;This has to do with using len() in <EM>where</EM> command with multivalue. &nbsp;Here's a working filter:</P><LI-CODE lang="markup">|where isnotnull(len('x.y.z{}.field') &gt; 20) |stats count by x.y.z{}.field</LI-CODE><P>Note, however, that count by an array field is not going to work too well if all you care are the values in the array whose length is greater than 20. &nbsp;In that case you'll have to apply the filter again after stats, like</P><LI-CODE lang="markup">|where isnotnull(len('x.y.z{}.field') &gt; 20) |stats count by x.y.z{}.field |where isnotnull(len('x.y.z{}.field') &gt; 20)</LI-CODE><P>&nbsp;</P> Tue, 25 May 2021 08:18:18 GMT https://community.splunk.com/t5/Splunk-Search/Filter-events-by-length-of-json-field/m-p/552906#M156948 yuanliu 2021-05-25T08:18:18Z