topic Re: How do we count the fields inside a JSON array? in Splunk Search

How do we count the fields inside a JSON array?

yahoohunk — Fri, 08 Apr 2016 23:02:59 GMT

Each log entry contains some json. There is a field that is an array. I want to count the items in that array.

Example json data
{
"field1": "sample",
"messages": [
"noop",
"missing",
"error",
"unknown"
]
}

We've tried index="test_index" | spath input=log | regex id = "a|b" | stats count(messages)

Our desired output is something like:
id message count
a noop 5
a error 8

martin_mueller — Fri, 08 Apr 2016 23:45:59 GMT

Assuming the array was extracted by the spath into the field messages{}, you can do this:

... | spath input=log | rename messages{} as messages | eval message_count = mvcount(messages) | stats sum(message_count)

yahoohunk — Mon, 11 Apr 2016 17:51:46 GMT

Thanks for the suggestion martin_mueller. We got what we wanted by using the following.

index="test_index" | spath input=log
| regex templateId = "10|15"
| stats count(eval(source == "mail")) AS COUNT by id,messages{}