topic Re: Eventstructure & "By" command / spath in Splunk Search

Eventstructure & "By" command / spath

HeinzWaescher — Tue, 14 Jan 2014 08:32:09 GMT

Hi,

I've got an event that looks like this:

rangeofproducts:{[-]

              products:[[-]
                {[-]
                  count:20
                  productID: A
                }
                {[-]
                  count:40
                  productID: B

So the fieldnames are:
rangeofproducts.products{}.count
rangeofproducts.products{}.productID

I would like to create a search thats results in the total count by productID for the event.
At the moment I think it won't work, but I hope I'm wrong...

| stats sum(rangeofproducts.products{}.count) by rangeofproducts.products{}.productID

This results in a total count of 60 for every productID. But a split 20/40 would be correct.

Best
Heinz

Re: Eventstructure & "By" command / spath

MuS — Tue, 14 Jan 2014 08:37:11 GMT

Hi HeinzWaescher,

looks like JSON data, have you tried the spath command on your event and do your stats after that?

hope this helps ...

cheers, MuS

Re: Eventstructure & "By" command / spath

HeinzWaescher — Tue, 14 Jan 2014 13:46:37 GMT

Hi MuS,

haven't heard about that command before, but it looks usefull for my problem. Thanks!

Re: Eventstructure & "By" command / spath

HeinzWaescher — Tue, 21 Jan 2014 11:39:54 GMT

Hi,

Example 3 of the spath documentation seems to be the apporach for my problem.

{"widget": {
"text": {
    "data": "Click here",
    "size": 36,
    "data": "Learn more",
    "size": 37,
    "data": "Help",
    "size": 38,

I've tried it out and adjusted this search:

sourcetype=json | spath | rename widget.text.size AS size, widget.text.data AS
data | eval x=mvzip(data,size)| mvexpand x | eval x = split(x,",") | eval
data=mvindex(x,0) | eval size=mvindex(x,1) | table _time,data, size

In the end the search created individual events, but there are always duplicates. When I use the same search without | spath | it seems to be correct, but I've no idea why.
Is there an important difference in the structure of my event?

Thanks in advance

Heinz