topic Help with A table data with multiple JSON fields in Splunk Search

Help with A table data with multiple JSON fields

shashaikhhh — Fri, 24 Jun 2022 15:55:24 GMT

I need count of cloudfront-viewer-country and sec-ch-ua-platform for each Origin

Please help.

Expected Result:

If site1 has only 2 countries and site2 has one extra platform, then the expected result should be like below.

Origin	Platform	Platform Count	Country	Country Count
https://www.site1.com	Android	10	US	22
	macOS	12	UK	3
	Windows	6
https://www.site2.com	Android	4	US	8
	macOS	4	UK	1
	Windows	2	AU	1
			IND	5

Data:

{
"additional": {
"method": "POST",
"url": "/api/resource/getContentEditorData",
"headers": {
"cloudfront-viewer-country": "US",
"origin": "https://www.site1.com",
"sec-ch-ua-platform": "\"Android\""
}
},
"level": "notice",
"message": "INCOMING REQUEST: POST /api/resource/getContentEditorData"
}

============

{
"additional": {
"method": "POST",
"url": "/api/resource/getContentEditorData",
"headers": {
"cloudfront-viewer-country": "UK",
"origin": "https://www.site1.com",
"sec-ch-ua-platform": "\"Windows\""
}
},
"level": "notice",
"message": "INCOMING REQUEST: POST /api/resource/getContentEditorData"
}

=========================

{
"additional": {
"method": "POST",
"url": "/api/resource/getContentEditorData",
"headers": {
"cloudfront-viewer-country": "AU",
"origin": "https://www.site2.com",
"sec-ch-ua-platform": "\"Windows\""
}
},
"level": "notice",
"message": "INCOMING REQUEST: POST /api/resource/getContentEditorData"
}

Re: A table data with multiple JSON fields

kamlesh_vaghela — Fri, 24 Jun 2022 08:39:33 GMT

@shashaikhhh

Can you please share some sample RAW (_raw field) events and the expected output from those events?

Bcoz I'm not able identify which events would fall under this scenario

Re: A table data with multiple JSON fields

shashaikhhh — Mon, 27 Jun 2022 10:39:04 GMT

{"additional":{"method":"POST","url":"/api/login/user","headers":{"accept-encoding":"gzip, deflate, br","appcontext":"marketplace","cloudfront-forwarded-proto":"https","cloudfront-is-desktop-viewer":"true","cloudfront-is-mobile-viewer":"false","cloudfront-is-smarttv-viewer":"false","cloudfront-is-tablet-viewer":"false","cloudfront-viewer-country":"","content-type":"application/json","origin":"https://www.myprepaidcenter.com","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"102\", \"Google Chrome\";v=\"102\"","sec-ch-ua-mobile":"?0","sec-ch-ua-platform":"\"Windows\"","sec-fetch-dest":"empty","sec-fetch-mode":"cors",,"connection":"Keep-Alive"},"body":{"agg":"prod-pri-b-10.185.32.135","index":"bhn_apps","host":"production-HI-Marketplace-Y"}

Re: Help with A table data with multiple JSON fields

yuanliu — Tue, 28 Jun 2022 06:15:51 GMT

What kamlesh_vaghela asks is an explanation of the requirement because the OP is extremely vague. For example, what constitutes a "Platform Count" and what constitutes a "Country Count"? Your illustrated outcome requires a lot more data than illustrated in the post, i.e., illustrated data is insufficient to produce the outcome, there is no mathematically unique solution.

Sometimes it is difficult to illustrate sufficient data. When this happens, the next best thing is to supply some pseudo code, or some of your failed code so others can more easily understand what you need.

After trying to assemble some scenarios to satisfy the outcome, I, too, failed to see what kind of data set can give you distinct "Platform Count" AND "Country Count" by origin. Please explain by additional data or by your attempted code.