Splunk Search

Count number of events by item in a JSON Array

mzeb
New Member

Use case, I have JSON events that contain an array of US states. I want to count the number of events by state.

For instance
Event 1:
{[NY,MA,ME]}

Event 2:
{[NY,FL,NM]}

the query would produce results of:
NY 2
MA 1
ME 1
FL 1
NM 1

Thanks!

Tags (1)
0 Karma

jacobpevans
Motivator

Assuming you properly ingested the data using a _json sourcetype, it would be done like as below. The "state" field name should be automatically extracted, but you did not say what it was in your question. The assumption is that Splunk is properly parsing the json which will give you a [State] field in a multi-valued field. You can then just expand the field and get a count of each.

| mvexpand [State]
| stats count by [State]
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...