Getting Data In

trouble with extracting data from JSON event

lwiechec
New Member

Hi, I am storing the events containing subscribers per subscription topics.

The events look like this:

{"type":"subscriptions","details":{"topic":"topic1","subscribers":["192.168.74.25","10.132.45.54"]}}
...
{"type":"subscriptions","details":{"topic":"topic2","subscribers":["192.168.74.26","10.132.45.54"]}}
...

I want to count all subscriptions per subscribers and plot it over time.

Until now I managed to extract the list of subscribers using this Splunk query:

source="mysource" | chart values(details.subscribers{}) as subscribers

I guess I should now use it in subquery ?

Any help would be appreciated!

Thanks,
L.

0 Karma

kmaron
Motivator

This would get you the number of events, which I think is what you mean by subscriptions, per subscriber over time.

source="mysource" | eval rename details.subscribers{} as subscribers | mvexpand subscribers | timechart count by subscribers
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>