Grouping by items in an array

[Maurice]

Hi,

I'm hoping someone can help me out here.

I have a property(books) on each event which holds an array of objects.

I would like to group by books{}.name with count on y axis and create a bar chart.

I tried using top books{}.name but this does not seem to give the correct results, seems to miss out on some groups all together

{

books:[

        {name: "book1"},

{name: "book2"},

{name: "book3"},

{name: "book3"},

{name: "book1"},

{name: "book1"},

      ]

}

Would you have an idea of how to fix this,

Kind Regards,

Maurice

[ITWhisperer · Accepted solution]

Are you extracting the fields with spath first?

| makeresults 
| eval _raw="{
\"books\":[
{\"name\": \"book1\"},
{\"name\": \"book2\"},
{\"name\": \"book3\"},
{\"name\": \"book3\"},
{\"name\": \"book1\"},
{\"name\": \"book1\"},
      ]
}"
| spath
| top books{}.name

[Maurice]

Thanks a million for the reply.

It really helped focus me in the correct direction.

I ended up having to put an explicit spath before each of my search command that referenced one of the complex object properties.

similar to:

| spath books{}.name
| search books{}.name
| top books{}.name