All Apps and Add-ons

JSON data, unexpected value count

phanikumarcs
Explorer

Hi,

When i want to extract the fields from JSON (below) destination,messages, inflightMessages.

This the one of the latest event:

{

  "analytics": [

     {

        "destination": "billing.events.prod",

        "messages": 0,

        "inflightMessages": 0

     },

     {

        "destination": "billing.events.dev",

        "messages": 0,

        "inflightMessages": 0

     },

     {

        "destination": "hub.values.prod",

        "messages": 0,

        "inflightMessages": 0

     },

     {

        "destination": "hub.fifo-prod",

        "messages": 0,

        "inflightMessages": 0

     }

   ]

}

This is the spl i am using:

index=myindex sourcetype=mysourcetype

| spath input=_raw

| table analytics{}.destination, analytics{}.messages, analytics{}.inflightMessages

 

Where i am getting in the intrested fields 

"analytics{}.destination" for this when i move curser to see values and count associated, for each value showing count 2, when you search for one event.

 

Why this is happening what is the issue? This data generally mulesoftmq.

 

 

 

Labels (1)
0 Karma

danielcj
Communicator

Hello @phanikumarcs ,

The spath command is duplicating the values of this event. Please try the following not using the spath command:

index=myindex sourcetype=mysourcetype
| table analytics{}.destination, analytics{}.messages, analytics{}.inflightMessages

 

Thanks.

0 Karma

phanikumarcs
Explorer

 

If you see what every i am trying its getting two same values 

20240209_093755.jpg

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like you have found 2 events in your search not 1, but your screenshot doesn't show how many events were returned. You could also look in your search log to see what is happening.

0 Karma

phanikumarcs
Explorer

@danielcj @ITWhisperer 
In this instance, I am utilizing the SPL. The most recent event I am obtaining is from a table, where I encounter repeated values in the 'destination field which is 2.'

index=foo sourcetype="foo" source="foo"
| spath input=_raw output=analytics path="analytics{}"
| rename "analytics{}.destination" as destination, "analytics{}.messages" as messages, "analytics{}.inflightMessages" as inflightMessages
| sort 0 -_time
| eventstats max(_time) as latestTime
| where _time = latestTime
| table destination, messages, inflightMessages
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There is nothing in this search that ensures you only have one event - you could have two events with exactly the same _time value - try something like this

| sort 0 -_time
| head 1
0 Karma

phanikumarcs
Explorer

i tried this as well earlier, may be the issue with MQ events.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not sure where MQ events come into it. When you tried with sort and head 1,  what did you get?

0 Karma

phanikumarcs
Explorer

@ITWhisperer 
in the events only 1 event getting, when you see in statistics getting same 2 values under destination in table.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

So the data is duplicated in the raw event?

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...