Getting Data In

Get count of top level keys from JSON?

Pramodkuber
Engager

my Splunk logs looks like below. Total keys could change based on use case. I need to get exact number of keys from below data and then what is the max key count among those. Please guide me here.

{
   level: INFO
   logger_name: com.123.logging
   process: NA
   requestId: 1234567
   attribute: email
   criteria: value
   path: aa.bb.cc
   service_name: SERVICE_NAME
   thread_name: h1234567
   timestamp: 2020-09-26T07:33:53.451Z
}

 

Labels (2)
0 Karma

Richfez
SplunkTrust
SplunkTrust

Do you mean "keys" as in, your example, 'level', 'logger_name', 'process', and so on?

If so, some variant of a search like

index=fw 
| fieldsummary 
| fields field, count
| search count>0 NOT field IN ("date*", "eventtype", "index", "linecount", "punct", "source", "sourcetype", "splunk_server", "splunk_server_group", "tag*", "timeendpos", "timestartpos")
| stats count

might do it.  You'll have to remove the "stats count" at the end to double-check that all the Splunk built-in fields are removed in that `NOT field IN ....` part of the search.

 

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...