https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-field-out-of-JSON-and-then-use-to-get-a-count/m-p/487899#M193869 <P>Thank you very much mayurr98. Worked perfectly!</P> Mon, 25 Nov 2019 14:40:56 GMT chktlm 2019-11-25T14:40:56Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-field-out-of-JSON-and-then-use-to-get-a-count/m-p/487897#M193867 <P>Hi. I am trying to get a count on the first field within my logs, of the requestBody json input. Below is an example of the log:</P> <PRE><CODE>2019-11-20 17:20:03,802 INFO [qqq1000000-10000] web.service.logging.IncomingRequest: ip=00.00.00.000, domain=http://url:0000/webService/web/Service/, username=null, date=[20/Nov/2019:17-20-03,802 +0000], method=POST uri=/webService/web/Service?schema=1.0&amp;form=JSON&amp;httpError=true&amp;cid=12345, status=200, contentLength=68, responseTime=190, userAgent=WebServiceClient&lt;Service&gt; 3.5, referrer=, cacheStatus=miss, cid=12345 requestBody={"createPerson":{"customerId":"55555555.customer"}}, x-accountexternalid=987654321, api=service.create, x-partner=Partner, cid=12345 </CODE></PRE> <P>How would I grab the first entry in the JSON of the requestBody element, and then make that a field, so I can get a count. From the example above, I would want to grab <EM>createPerson</EM> from the requestBody section. Make this a field so I can then grab a count of the incoming requestBody first element? There would be other fields besides just <EM>createPerson</EM>. So I just want to extract that field within the quote, and get the count for each different element that is in that position of our incoming requests.</P> Wed, 20 Nov 2019 17:39:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-field-out-of-JSON-and-then-use-to-get-a-count/m-p/487897#M193867 chktlm 2019-11-20T17:39:00Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-field-out-of-JSON-and-then-use-to-get-a-count/m-p/487898#M193868 <P>try this:</P> <PRE><CODE>...| rex "requestBody=\{\"(?&lt;requestBody&gt;\w+)" | stats count by requestBody </CODE></PRE> Wed, 20 Nov 2019 18:18:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-field-out-of-JSON-and-then-use-to-get-a-count/m-p/487898#M193868 mayurr98 2019-11-20T18:18:25Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-field-out-of-JSON-and-then-use-to-get-a-count/m-p/487899#M193869 <P>Thank you very much mayurr98. Worked perfectly!</P> Mon, 25 Nov 2019 14:40:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-field-out-of-JSON-and-then-use-to-get-a-count/m-p/487899#M193869 chktlm 2019-11-25T14:40:56Z