Splunk Search

Count number of events by item in a JSON Array

mzeb
New Member

Use case, I have JSON events that contain an array of US states. I want to count the number of events by state.

For instance
Event 1:
{[NY,MA,ME]}

Event 2:
{[NY,FL,NM]}

the query would produce results of:
NY 2
MA 1
ME 1
FL 1
NM 1

Thanks!

Tags (1)
0 Karma

jacobpevans
Motivator

Assuming you properly ingested the data using a _json sourcetype, it would be done like as below. The "state" field name should be automatically extracted, but you did not say what it was in your question. The assumption is that Splunk is properly parsing the json which will give you a [State] field in a multi-valued field. You can then just expand the field and get a count of each.

| mvexpand [State]
| stats count by [State]
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...