https://community.splunk.com/t5/Splunk-Search/How-to-count-the-size-of-json-array-of-a-single-event/m-p/103568#M26771 <P>You can use the spath command.</P> <P><CODE>your_search | spath path=a{} output=name | stats count(name) as name</CODE></P> <P><CODE><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath" target="test_blank">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath</A></CODE></P> Thu, 17 Oct 2013 11:39:08 GMT alacercogitatus 2013-10-17T11:39:08Z https://community.splunk.com/t5/Splunk-Search/How-to-count-the-size-of-json-array-of-a-single-event/m-p/103567#M26770 <P>How to count the size of json array of a single event</P> <P>For example {"a" : [{"b": true}, {"b": true}, {"c": true}]}</P> <PRE><CODE>name size =========== a 3 </CODE></PRE> Thu, 17 Oct 2013 10:52:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-the-size-of-json-array-of-a-single-event/m-p/103567#M26770 wood1986 2013-10-17T10:52:47Z https://community.splunk.com/t5/Splunk-Search/How-to-count-the-size-of-json-array-of-a-single-event/m-p/103568#M26771 <P>You can use the spath command.</P> <P><CODE>your_search | spath path=a{} output=name | stats count(name) as name</CODE></P> <P><CODE><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath" target="test_blank">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath</A></CODE></P> Thu, 17 Oct 2013 11:39:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-the-size-of-json-array-of-a-single-event/m-p/103568#M26771 alacercogitatus 2013-10-17T11:39:08Z https://community.splunk.com/t5/Splunk-Search/How-to-count-the-size-of-json-array-of-a-single-event/m-p/103569#M26772 <P>my example is too simple. for a single event<BR /> {"id": 32413<BR /> "a" : [{"b": true}, {"b": true}, {"c": true}].<BR /> "z" : [{"a": 1}, {"d":2}]}</P> <P>I want this output</P> <PRE><CODE>id a z ============= 32413 3 2 </CODE></PRE> Thu, 17 Oct 2013 14:12:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-the-size-of-json-array-of-a-single-event/m-p/103569#M26772 wood1986 2013-10-17T14:12:49Z https://community.splunk.com/t5/Splunk-Search/How-to-count-the-size-of-json-array-of-a-single-event/m-p/103570#M26773 <P><CODE>your_search | spath path=a{} output=aName | spath path=z{} output=zName | stats count(aName) as a count(zName) as z by id</CODE></P> Thu, 17 Oct 2013 16:30:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-the-size-of-json-array-of-a-single-event/m-p/103570#M26773 alacercogitatus 2013-10-17T16:30:56Z