Splunk Search

Count values in array of objects based on other attributes in that object

krussche
Observer

I have an array of objects containing  field componentType with value "Software" or "Licenses".  In the same object there is a field downloadCount expressing how many files were downloaded for that software / license.  I need to create a table where each row shows the total number of file downloads for both software and licenses per array of objects.
e.g.
Software Downloads.    License Downloads

5                                                1

0                                               0

...                                               ...

here is how one row of the data looks.
[
{componentType=Software, downloadCount=2},
{componentType=License, downloadCount=1},
{componentType=Software, downloadCount=3}
]

Any help is appreciated 🙂

Labels (5)
0 Karma

to4kawa
Ultra Champion

sample:

| makeresults 
| eval _raw="[
{componentType=Software, downloadCount=2},
{componentType=License, downloadCount=1},
{componentType=Software, downloadCount=3}
]"
| multikv noheader=t
| kv
| stats sum(downloadCount) by componentType

but your log is not actual. so, kv can't work

0 Karma

krussche
Observer

Unfortunately this didn't work.  

To clarify my results are tabled where each row in the table looks like this:

[
{componentType=Software, downloadCount=2},
{componentType=License, downloadCount=1},
{componentType=Software, downloadCount=3}
]

Then i need the resulting table to be like this

software    License

5.                   1           <-- from table row shown above

99                  99.      <-- next row from original table not shown

88.                 88       <--3rd row in my original table not shown

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...