Extracting simple array of strings

[sankarms]

I have a simple entry in my logs like so:

types=["A","B","C"]

There are several entries like that throughout the logs. Another one could look like this:

types=["B","C"]

Is there a way to extract the values from this array of strings and create a bar chart out of the occurrences of each type? So if splunk only saw the above 2 long entries it would make a bar chart with

• "# of occurrences" on the y-axis
• "Types" on the x-axis

And it would show 1 for type A, 2 for type B and C.

What would be the search criterion?

[martin_mueller · Accepted solution]

You could cheat by going through spath parsing JSON:

... | eval types = "{\"types\": " + types + "}" | spath input=types | rename types{} as types | stats count by types

Alternatively, a bit of regexing around:

... | eval types = replace(types, "(^\[\")|(\"\]$)", "")| makemv types delim="\",\"" | stats count by types

[martin_mueller]

What does the statistics table look like, and what visualization are you using?

[martin_mueller]

Odd - what happens when you run this in an empty search bar?

| stats count | eval foo = "types=[\"A\",\"B\",\"C\"] types=[\"B\",\"C\"]" | makemv foo | mvexpand foo | rename foo as _raw | extract | eval types = replace(types, "(^\[\")|(\"\]$)", "")| makemv types delim="\",\"" | stats count by types

[sankarms]

Sorry I'm an absolute idiot. I messed up something from your original command. It works perfectly fine now. Thank you.

[sankarms]

this doesn't extract the individual types separately. This gives back the whole list like so

["A","B","C"]

and counts it as 1 object.