Getting Data In

trouble with extracting data from JSON event

New Member

Hi, I am storing the events containing subscribers per subscription topics.

The events look like this:


I want to count all subscriptions per subscribers and plot it over time.

Until now I managed to extract the list of subscribers using this Splunk query:

source="mysource" | chart values(details.subscribers{}) as subscribers

I guess I should now use it in subquery ?

Any help would be appreciated!


0 Karma


This would get you the number of events, which I think is what you mean by subscriptions, per subscriber over time.

source="mysource" | eval rename details.subscribers{} as subscribers | mvexpand subscribers | timechart count by subscribers
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>