topic Re: Want To extract fields and values from JSON in Splunk Search

Want To extract fields and values from JSON

gauravkumar85 — Thu, 27 Jun 2024 19:25:58 GMT

Below is my row text in Splunk and i want to extract JSON array from from below row text.

After extract I want to do group by ARUNAME and wanted to calculate the sum of SKIPPED and PROCESSED value

{"id":"0","severity":"Information","message":"[{\"TARGETSYSTEM\"‌:confused_face:‌"CPW\",\"ARUNAME\"‌:confused_face:‌"CPW_ARO_P\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":36,\"PROCESSING\":0,\"DATE\"‌:confused_face:‌"6/27/2024\",\"DAYHOUR\":23},{\"TARGETSYSTEM\"‌:confused_face:‌"CPW\",\"ARUNAME\"‌:confused_face:‌"CPW_ARO_P\",\"TOTAL\":0,\"PROCESSED\":8,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\"‌:confused_face:‌"6/27/2024\",\"DAYHOUR\":23},{\"TARGETSYSTEM\"‌:confused_face:‌"CPW\",\"ARUNAME\"‌:confused_face:‌"CPW_ARO_P\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\"‌:confused_face:‌"6/27/2024\",\"DAYHOUR\":23},{\"TARGETSYSTEM\"‌:confused_face:‌"CPW\",\"ARUNAME\"‌:confused_face:‌"CPW_00410\",\"TOTAL\":0,\"PROCESSED\":4,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\"‌:confused_face:‌"6/27/2024\",\"DAYHOUR\":23},{\"TARGETSYSTEM\"‌:confused_face:‌"CPW\",\"ARUNAME\"‌:confused_face:‌"CPW_ARO_H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":29,\"PROCESSING\":0,\"DATE\"‌:confused_face:‌"6/27/2024\",\"DAYHOUR\":23},{\"TARGETSYSTEM\"‌:confused_face:‌"CPW\",\"ARUNAME\"‌:confused_face:‌"CPW_00410\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\"‌:confused_face:‌"6/27/2024\",\"DAYHOUR\":23},{\"TARGETSYSTEM\"‌:confused_face:‌"CPW\",\"ARUNAME\"‌:confused_face:‌"CPW_ARO_H\",\"TOTAL\":0,\"PROCESSED\":139,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\"‌:confused_face:‌"6/27/2024\",\"DAYHOUR\":23}]"}

Re: Want To extract fields and values from JSON

gauravkumar85 — Thu, 27 Jun 2024 19:28:40 GMT

Here is the exact Message which have

message: [{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_ARO_P","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":36,"PROCESSING":0,"DATE":"6/27/2024","DAYHOUR":23},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_ARO_P","TOTAL":0,"PROCESSED":8,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"6/27/2024","DAYHOUR":23},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_ARO_P","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":1,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"6/27/2024","DAYHOUR":23},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00410","TOTAL":0,"PROCESSED":4,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"6/27/2024","DAYHOUR":23},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_ARO_H","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":29,"PROCESSING":0,"DATE":"6/27/2024","DAYHOUR":23},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00410","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"6/27/2024","DAYHOUR":23},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_ARO_H","TOTAL":0,"PROCESSED":139,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"6/27/2024","DAYHOUR":23}]

Re: Want To extract fields and values from JSON

yuanliu — Fri, 28 Jun 2024 02:34:25 GMT

A lesson for everyone who post in this board: Carefully copy raw text in pure text format. Your initial post contains so many control characters it took me an hour to clean up and reconstruct valid JSON.

Once JSON is cleaned up, the solution is really simple.

| spath input=message path={} | mvexpand {} | spath input={} | fields SKIPPED PROCESSED ARUNAME | stats sum(*) as * by ARUNAME

This should give you

ARUNAME	PROCESSED	SKIPPED
CPW_00410	4	1
CPW_ARO_H	139	29
CPW_ARO_P	8	36

Here is the emulation that finally reached. Play with it and compare with real data

| makeresults | eval _raw="{ \"id\": \"0\", \"severity\": \"Information\", \"message\": \"[{\\\"TARGETSYSTEM\\\":\\\"CPW\\\",\\\"ARUNAME\\\":\\\"CPW_ARO_P\\\",\\\"TOTAL\\\":0,\\\"PROCESSED\\\":0,\\\"REMAINING\\\":0,\\\"ERROR\\\":0,\\\"FAILED\\\":0,\\\"SKIPPED\\\":36,\\\"PROCESSING\\\":0,\\\"DATE\\\":\\\"6/27/2024\\\",\\\"DAYHOUR\\\":23},{\\\"TARGETSYSTEM\\\":\\\"CPW\\\",\\\"ARUNAME\\\":\\\"CPW_ARO_P\\\",\\\"TOTAL\\\":0,\\\"PROCESSED\\\":8,\\\"REMAINING\\\":0,\\\"ERROR\\\":0,\\\"FAILED\\\":0,\\\"SKIPPED\\\":0,\\\"PROCESSING\\\":0,\\\"DATE\\\":\\\"6/27/2024\\\",\\\"DAYHOUR\\\":23},{\\\"TARGETSYSTEM\\\":\\\"CPW\\\",\\\"ARUNAME\\\":\\\"CPW_ARO_P\\\",\\\"TOTAL\\\":0,\\\"PROCESSED\\\":0,\\\"REMAINING\\\":0,\\\"ERROR\\\":1,\\\"FAILED\\\":0,\\\"SKIPPED\\\":0,\\\"PROCESSING\\\":0,\\\"DATE\\\":\\\"6/27/2024\\\",\\\"DAYHOUR\\\":23},{\\\"TARGETSYSTEM\\\":\\\"CPW\\\",\\\"ARUNAME\\\":\\\"CPW_00410\\\",\\\"TOTAL\\\":0,\\\"PROCESSED\\\":4,\\\"REMAINING\\\":0,\\\"ERROR\\\":0,\\\"FAILED\\\":0,\\\"SKIPPED\\\":0,\\\"PROCESSING\\\":0,\\\"DATE\\\":\\\"6/27/2024\\\",\\\"DAYHOUR\\\":23},{\\\"TARGETSYSTEM\\\":\\\"CPW\\\",\\\"ARUNAME\\\":\\\"CPW_ARO_H\\\",\\\"TOTAL\\\":0,\\\"PROCESSED\\\":0,\\\"REMAINING\\\":0,\\\"ERROR\\\":0,\\\"FAILED\\\":0,\\\"SKIPPED\\\":29,\\\"PROCESSING\\\":0,\\\"DATE\\\":\\\"6/27/2024\\\",\\\"DAYHOUR\\\":23},{\\\"TARGETSYSTEM\\\":\\\"CPW\\\",\\\"ARUNAME\\\":\\\"CPW_00410\\\",\\\"TOTAL\\\":0,\\\"PROCESSED\\\":0,\\\"REMAINING\\\":0,\\\"ERROR\\\":0,\\\"FAILED\\\":0,\\\"SKIPPED\\\":1,\\\"PROCESSING\\\":0,\\\"DATE\\\":\\\"6/27/2024\\\",\\\"DAYHOUR\\\":23},{\\\"TARGETSYSTEM\\\":\\\"CPW\\\",\\\"ARUNAME\\\":\\\"CPW_ARO_H\\\",\\\"TOTAL\\\":0,\\\"PROCESSED\\\":139,\\\"REMAINING\\\":0,\\\"ERROR\\\":0,\\\"FAILED\\\":0,\\\"SKIPPED\\\":0,\\\"PROCESSING\\\":0,\\\"DATE\\\":\\\"6/27/2024\\\",\\\"DAYHOUR\\\":23}]\" }" | spath ``` data emulation above ```

Re: Want To extract fields and values from JSON

gauravkumar85 — Tue, 09 Jul 2024 12:07:42 GMT

I am using below query and its throwing [nxg-splunk-idx503,nxg-splunk-idx504,nxg-splunk-idx506] Field 'collection' does not exist in the data. Same query is working fine for other events. Its only failing for the hour 5 and 4

index = ***** host=**** source=***| spath | eval message="{\"message\":".message."}" | spath input=message message{} output=collection | mvexpand collection | spath input=collection |eval totalCount = SKIPPED + PROCESSED|chart sum(SKIPPED) as SKIPPED,sum(PROCESSED) as Processed sum(totalCount) as TotalClaims by DAYHOUR DATE

Below is my two ROW event-

Event 1

{"id":"0","severity":"Information","message":"[{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00253\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00314\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":6,\"FAILED\":6,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00314\",\"TOTAL\":0,\"PROCESSED\":7295,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00303\",\"TOTAL\":0,\"PROCESSED\":8,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00355\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":22,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_01015\",\"TOTAL\":0,\"PROCESSED\":3,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":5}{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00302\",\"TOTAL\":0,\"PROCESSED\":116,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":5}]"}

Event 2

{"id":"0","severity":"Information","message":"[{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00253\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00797H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00365\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":511,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00365\",\"TOTAL\":0,\"PROCESSED\":210,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00410\",\"TOTAL\":0,\"PROCESSED\":8,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00410\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":21,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":4}]"}

You know its scanned 8 events and its matched with only 5 . Now sure why those events which is generated in hour 4 and 5 are not matching

Re: Want To extract fields and values from JSON

gauravkumar85 — Tue, 09 Jul 2024 12:21:04 GMT

Below is my two ROW event-

message: [{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00253","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00314","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":6,"FAILED":6,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00314","TOTAL":0,"PROCESSED":7295,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00052Med","TOTAL":0,"PROCESSED":273,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00011H","TOTAL":0,"PROCESSED":23,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00303","TOTAL":0,"PROCESSED":8,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00355","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":22,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_01015","TOTAL":0,"PROCESSED":3,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00011H","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":2,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00314","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":38,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00355","TOTAL":0,"PROCESSED":44,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00364","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":6,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00302","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":2,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00364","TOTAL":0,"PROCESSED":7177,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00302","TOTAL":0,"PROCESSED":116,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00607Bundle","TOTAL":0,"PROCESSED":37,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00086","TOTAL":0,"PROCESSED":215,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00061","TOTAL":0,"PROCESSED":4,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00607Bundle","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":14,"FAILED":14,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00030","TOTAL":0,"PROCESSED":21,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00075Med","TOTAL":0,"PROCESSED":546,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00030","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":801,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00022AdjPro","TOTAL":0,"PROCESSED":150,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00473H","TOTAL":0,"PROCESSED":69,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00075Med","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":542,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00607Bundle","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":2,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00022AdjPro","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":335,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00473H","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":10,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00304","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":12,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00304","TOTAL":0,"PROCESSED":637,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00396","TOTAL":0,"PROCESSED":2,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00079MEDICA","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":88,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00086","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00079MEDICA","TOTAL":0,"PROCESSED":24,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00304","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":1,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00022AdjPro","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":1,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5}]

Re: Want To extract fields and values from JSON

yuanliu — Tue, 09 Jul 2024 17:07:06 GMT

Thank you for reposting data as plain text and not emojis😀. Let this be a lesson for everyone using this board: make use of the text block (that </> button in editor) and you can avoid mishaps. Another good practice is to use Splunk's autoformat function in search window.

Anyway, the logic behind | spath | eval message="{\"message\":".message."}" escapes me, because first, without any prompt, Splunk should have given you a whole number of multi-valued fields such as {}.TARGETSYSTEM and {}.ARUNAME. Adding another spath only doubles their entry. Second, I do not see any field name message. Are your event illustrations of _raw events or of a particular field named message that has been extracted by Splunk? If it is the latter, there is no reason why your search wouldn't give the desired results.

Here is an emulation of "message" field in your illustrations:

| makeresults | eval message=mvappend("[{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00253\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00314\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":6,\"FAILED\":6,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00314\",\"TOTAL\":0,\"PROCESSED\":7295,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00052Med\",\"TOTAL\":0,\"PROCESSED\":273,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00011H\",\"TOTAL\":0,\"PROCESSED\":23,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00303\",\"TOTAL\":0,\"PROCESSED\":8,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00355\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":22,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_01015\",\"TOTAL\":0,\"PROCESSED\":3,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00011H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00314\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":38,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00355\",\"TOTAL\":0,\"PROCESSED\":44,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00364\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":6,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00302\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00364\",\"TOTAL\":0,\"PROCESSED\":7177,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00302\",\"TOTAL\":0,\"PROCESSED\":116,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00607Bundle\",\"TOTAL\":0,\"PROCESSED\":37,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00086\",\"TOTAL\":0,\"PROCESSED\":215,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00061\",\"TOTAL\":0,\"PROCESSED\":4,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00607Bundle\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":14,\"FAILED\":14,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00030\",\"TOTAL\":0,\"PROCESSED\":21,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00075Med\",\"TOTAL\":0,\"PROCESSED\":546,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00030\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":801,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00022AdjPro\",\"TOTAL\":0,\"PROCESSED\":150,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00473H\",\"TOTAL\":0,\"PROCESSED\":69,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00075Med\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":542,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00607Bundle\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00022AdjPro\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":335,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00473H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":10,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00304\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":12,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00304\",\"TOTAL\":0,\"PROCESSED\":637,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00396\",\"TOTAL\":0,\"PROCESSED\":2,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00079MEDICA\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":88,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00086\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00079MEDICA\",\"TOTAL\":0,\"PROCESSED\":24,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00304\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00022AdjPro\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5}]", "[{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00253\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00797H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00365\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":511,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00365\",\"TOTAL\":0,\"PROCESSED\":210,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00410\",\"TOTAL\":0,\"PROCESSED\":8,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00396\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00410\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":21,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4}]") | mvexpand message ``` the above emulates the "message" field from index = ***** host=**** source=*** ```

Apply your search (skip that first spath) with Splunk autoformat

| eval message="{\"message\":".message."}" | spath input=message message{} output=collection | mvexpand collection | spath input=collection | eval totalCount = SKIPPED + PROCESSED | chart sum(SKIPPED) as SKIPPED,sum(PROCESSED) as Processed sum(totalCount) as TotalClaims by DAYHOUR DATE

I get this table:

DAYHOUR	Processed: 7/9/2024	SKIPPED: 7/9/2024	TotalClaims: 7/9/2024
4	218	536	754
5	16644	1862	18506

If the two illustrations are for raw events, emulation is like the following:

| makeresults | eval data=mvappend("[{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00253\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00314\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":6,\"FAILED\":6,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00314\",\"TOTAL\":0,\"PROCESSED\":7295,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00052Med\",\"TOTAL\":0,\"PROCESSED\":273,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00011H\",\"TOTAL\":0,\"PROCESSED\":23,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00303\",\"TOTAL\":0,\"PROCESSED\":8,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00355\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":22,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_01015\",\"TOTAL\":0,\"PROCESSED\":3,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00011H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00314\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":38,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00355\",\"TOTAL\":0,\"PROCESSED\":44,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00364\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":6,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00302\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00364\",\"TOTAL\":0,\"PROCESSED\":7177,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00302\",\"TOTAL\":0,\"PROCESSED\":116,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00607Bundle\",\"TOTAL\":0,\"PROCESSED\":37,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00086\",\"TOTAL\":0,\"PROCESSED\":215,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00061\",\"TOTAL\":0,\"PROCESSED\":4,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00607Bundle\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":14,\"FAILED\":14,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00030\",\"TOTAL\":0,\"PROCESSED\":21,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00075Med\",\"TOTAL\":0,\"PROCESSED\":546,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00030\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":801,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00022AdjPro\",\"TOTAL\":0,\"PROCESSED\":150,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00473H\",\"TOTAL\":0,\"PROCESSED\":69,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00075Med\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":542,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00607Bundle\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00022AdjPro\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":335,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00473H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":10,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00304\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":12,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00304\",\"TOTAL\":0,\"PROCESSED\":637,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00396\",\"TOTAL\":0,\"PROCESSED\":2,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00079MEDICA\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":88,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00086\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00079MEDICA\",\"TOTAL\":0,\"PROCESSED\":24,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00304\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00022AdjPro\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5}]", "[{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00253\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00797H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00365\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":511,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00365\",\"TOTAL\":0,\"PROCESSED\":210,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00410\",\"TOTAL\":0,\"PROCESSED\":8,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00396\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00410\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":21,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4}]") | mvexpand data | rename data as _raw | spath ``` the above emulates index = ***** host=**** source=*** ```

Use a slightly modified search from your original,

| fields - {}.* ``` opitional - just to clear view during development ``` | spath path={} ``` you can directly use {} as fieldname, no need to append ``` | mvexpand {} | fields - _* | spath input={} | eval totalCount = SKIPPED + PROCESSED | chart sum(SKIPPED) as SKIPPED,sum(PROCESSED) as Processed sum(totalCount) as TotalClaims by DAYHOUR DATE

This gives the exact same result. Could you clarify?

Re: Want To extract fields and values from JSON

PickleRick — Tue, 09 Jul 2024 18:51:59 GMT

If you look into the opening message of this thread you'll see a json entity with a message field containing a string which - when parsed out from the original event and then parsed as a json structure returns fields. And I suppose that's the problem - the "sub-json" is actually a string within the original json structure.

Re: Want To extract fields and values from JSON

yuanliu — Wed, 10 Jul 2024 03:22:31 GMT

You are correct; in my first comment, I even emulated the illustrated event in OP that contains a key named "message". In all cases, this key should have been extracted into Splunk field "message" without any processing, and @gauravkumar85's search should succeed (without that spurious spath). @gauravkumar85 do you get "message" field extracted in these two events? It would be much better if you simply copies the exact raw events (use code box, no emojis) that you think are causing problem.

Re: Want To extract fields and values from JSON

gauravkumar85 — Mon, 15 Jul 2024 21:09:53 GMT

My actually event look like below. And I am searching on last 24 Hours events.

When I am using below query

index = cba_hcck8s_UHGWM110-013948 host=prod_poc source=poc| spath | eval message="{\"message\":".message."}" | spath input=message message{} output=collection | mvexpand collection | spath input=collection |eval totalCount = SKIPPED + PROCESSED|chart sum(totalCount) as TotalClaims by DAYHOUR DATE

its not giving me below given events if I am removing the spath then its start matching below events only and rest of the events not matching. not sure why its behaving like this.

Event-

Event-

[{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00011H","TOTAL":0,"PROCESSED":1,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00011H","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":35,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00061","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_HOSPICE","TOTAL":0,"PROCESSED":27,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_HOSPICE","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":60,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_HOSPICE_CLM","TOTAL":0,"PROCESSED":1240,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_HOSPICE_CLM","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":14,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16}]

Re: Want To extract fields and values from JSON

yuanliu — Mon, 15 Jul 2024 20:05:27 GMT

Thank you for sharing text raw events. I plugged your new text into emulation. Still get the correct results. Can you run the emulation and compare with real data?

| makeresults | eval data=mvappend("[{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00031AdjPro\",\"TOTAL\":0,\"PROCESSED\":1,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00031AdjPro\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2118,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00035\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00035Med\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00052Med\",\"TOTAL\":0,\"PROCESSED\":2898,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00052Med\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":3,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00075\",\"TOTAL\":0,\"PROCESSED\":94,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00075\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":2,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00075\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":59,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00119\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":3,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00201H\",\"TOTAL\":0,\"PROCESSED\":1,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00243\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00243\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00283H\",\"TOTAL\":0,\"PROCESSED\":7,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00283H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":104,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00302\",\"TOTAL\":0,\"PROCESSED\":1395,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00302\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":5,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00304\",\"TOTAL\":0,\"PROCESSED\":299,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00304\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":16,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00310\",\"TOTAL\":0,\"PROCESSED\":2,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00365\",\"TOTAL\":0,\"PROCESSED\":588,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00365\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":619,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00479H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":4,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00479H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00607Bundle\",\"TOTAL\":0,\"PROCESSED\":1,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00646\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00646\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00681\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00721H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_02071\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":2,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_02229\",\"TOTAL\":0,\"PROCESSED\":1,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_02278\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_HOSPICE_CLM\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15}]", "[{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00011H\",\"TOTAL\":0,\"PROCESSED\":1,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":16},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00011H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":35,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":16},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00061\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":16},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_HOSPICE\",\"TOTAL\":0,\"PROCESSED\":27,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":16},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_HOSPICE\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":60,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":16},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_HOSPICE_CLM\",\"TOTAL\":0,\"PROCESSED\":1240,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":16},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_HOSPICE_CLM\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":14,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":16}]") | mvexpand data | rename data as _raw | spath ``` the above emulates index = ***** host=**** source=*** ```

The search used is the same as I posted previously (except substituting with your index search with emulation).

index = cba_hcck8s_UHGWM110-013948 host=prod_poc source=poc | fields - {}.* ``` optional ``` | spath path={} | mvexpand {} | fields - _* ``` optional ``` | spath input={} | eval totalCount = SKIPPED + PROCESSED | chart sum(SKIPPED) as SKIPPED,sum(PROCESSED) as Processed sum(totalCount) as TotalClaims by DAYHOUR DATE

And result is

DAYHOUR	Processed: 7/14/2024	SKIPPED: 7/14/2024	TotalClaims: 7/14/2024
15	5287	2930	8217
16	1268	110	1378

Re: Want To extract fields and values from JSON

gauravkumar85 — Tue, 16 Jul 2024 10:52:56 GMT

This query is working fine with the given example

But when I am running given query in index it not producing any result.

index = cba_hcck8s_UHGWM110-013948 host=prod_poc source=poc
| fields - {}.* ``` optional ```
| spath path={}
| mvexpand {}
| fields - _* ``` optional ```
| spath input={}
| eval totalCount = SKIPPED + PROCESSED
| chart sum(SKIPPED) as SKIPPED,sum(PROCESSED) as Processed sum(totalCount) as TotalClaims by DAYHOUR DATE

I am getting no result with this query.

You know my data reside in message under event field. Might be this query not reaching message field where rest of the data stored in array.

Also adding my row text