Splunk Enterprise

parsing out value from multi value field

dtakacssplunk
Explorer

I have data in the following form:

field A,    field B(this is an array)

a              {"k":1}

                {"k":2}

                {"k":3}

b              {"k":1}

                {"k":1}

                {"k":1}

field B is an array, I want to produce table like this

field A, sumB

a     6

b    3

what is the way to extract the values and add them up?

my thinking was to do 

| eval value=spath(fieldB, "k") 

and I was expecting values to have array 1,2,3 and 1,1,1 but they did not

Labels (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

| rex field=fieldB "k\":(?<fieldb_val>\d+)"

| stats sum(fieldb_val) by fieldA

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...