Getting Data In

trouble with extracting data from JSON event

New Member

Hi, I am storing the events containing subscribers per subscription topics.

The events look like this:


I want to count all subscriptions per subscribers and plot it over time.

Until now I managed to extract the list of subscribers using this Splunk query:

source="mysource" | chart values(details.subscribers{}) as subscribers

I guess I should now use it in subquery ?

Any help would be appreciated!


0 Karma

Re: trouble with extracting data from JSON event


This would get you the number of events, which I think is what you mean by subscriptions, per subscriber over time.

source="mysource" | eval rename details.subscribers{} as subscribers | mvexpand subscribers | timechart count by subscribers
0 Karma