Getting Data In

how to sum the machine OS in a JSON file

garumaru
Explorer

Hi Guys,

I have a JSON file for OS type in some cluster like below:

{
"clusterA": ubuntu,
"clusterA": ubuntu,
"clusterA": rhel5,
"clusterA": sles11,
"clusterB": sles11,
"clusterB": sles11,
"clusterB": ubuntu,
"clusterC": centos,
"clusterC": ubuntu
...
}

I'd like sum the OS type for each cluster, like in above sample, 2 ubuntu in clusterA, 1 rhel5 in clusterA etc.
Would you please kindly help out?

Thank you!

0 Karma

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval json="{\"clusterA\": ubuntu,
 \"clusterA\": ubuntu,
 \"clusterA\": rhel5,
 \"clusterA\": sles11,
 \"clusterB\": sles11,
 \"clusterB\": sles11,
 \"clusterB\": ubuntu,
 \"clusterC\": centos,
 \"clusterC\": ubuntu}" 
| eval json=replace(json,"\"|{|\s|}","") 
| makemv delim="," json 
| mvexpand json 
| eval temp=split(json,":"),cluster=mvindex(temp,0),os=mvindex(temp,1) 
| stats count by cluster,os
0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="{\"clusterA\": ubuntu,
\"clusterA\": ubuntu,
\"clusterA\": rhel5,
\"clusterA\": sles11,
\"clusterB\": sles11,
\"clusterB\": sles11,
\"clusterB\": ubuntu,
\"clusterC\": centos,
\"clusterC\": ubuntu}"
| rex mode=sed "s/: (\w+)/: \"\1\"/g"
| spath
| foreach cluster* [ eval <<FIELD>> = mvjoin('<<FIELD>>' , ",")]
| untable _time cluster OS
| eval OS = split(OS,",")
| mvexpand OS
| stats count by OS cluster
| sort cluster
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...