- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
JSON data, unexpected value count
Hi,
When i want to extract the fields from JSON (below) destination,messages, inflightMessages.
This the one of the latest event:
{
"analytics": [
{
"destination": "billing.events.prod",
"messages": 0,
"inflightMessages": 0
},
{
"destination": "billing.events.dev",
"messages": 0,
"inflightMessages": 0
},
{
"destination": "hub.values.prod",
"messages": 0,
"inflightMessages": 0
},
{
"destination": "hub.fifo-prod",
"messages": 0,
"inflightMessages": 0
}
]
}
This is the spl i am using:
index=myindex sourcetype=mysourcetype
| spath input=_raw
| table analytics{}.destination, analytics{}.messages, analytics{}.inflightMessages
Where i am getting in the intrested fields
"analytics{}.destination" for this when i move curser to see values and count associated, for each value showing count 2, when you search for one event.
Why this is happening what is the issue? This data generally mulesoftmq.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @phanikumarcs ,
The spath command is duplicating the values of this event. Please try the following not using the spath command:
index=myindex sourcetype=mysourcetype
| table analytics{}.destination, analytics{}.messages, analytics{}.inflightMessages
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you see what every i am trying its getting two same values
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

It looks like you have found 2 events in your search not 1, but your screenshot doesn't show how many events were returned. You could also look in your search log to see what is happening.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@danielcj @ITWhisperer
In this instance, I am utilizing the SPL. The most recent event I am obtaining is from a table, where I encounter repeated values in the 'destination field which is 2.'
index=foo sourcetype="foo" source="foo"
| spath input=_raw output=analytics path="analytics{}"
| rename "analytics{}.destination" as destination, "analytics{}.messages" as messages, "analytics{}.inflightMessages" as inflightMessages
| sort 0 -_time
| eventstats max(_time) as latestTime
| where _time = latestTime
| table destination, messages, inflightMessages
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

There is nothing in this search that ensures you only have one event - you could have two events with exactly the same _time value - try something like this
| sort 0 -_time
| head 1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i tried this as well earlier, may be the issue with MQ events.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Not sure where MQ events come into it. When you tried with sort and head 1, what did you get?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@ITWhisperer
in the events only 1 event getting, when you see in statistics getting same 2 values under destination in table.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

So the data is duplicated in the raw event?
