Splunk Search

Eventstructure & "By" command / spath

Motivator

Hi,

I've got an event that looks like this:

rangeofproducts:{[-]

              products:[[-]
                {[-]
                  count:20
                  productID: A
                }
                {[-]
                  count:40
                  productID: B

So the fieldnames are:
rangeofproducts.products{}.count
rangeofproducts.products{}.productID

I would like to create a search thats results in the total count by productID for the event.
At the moment I think it won't work, but I hope I'm wrong...

| stats sum(rangeofproducts.products{}.count) by rangeofproducts.products{}.productID

This results in a total count of 60 for every productID. But a split 20/40 would be correct.

Best
Heinz

Tags (4)
0 Karma

Motivator

Hi,

Example 3 of the spath documentation seems to be the apporach for my problem.

{"widget": {
"text": {
    "data": "Click here",
    "size": 36,
    "data": "Learn more",
    "size": 37,
    "data": "Help",
    "size": 38,

I've tried it out and adjusted this search:

sourcetype=json | spath | rename widget.text.size AS size, widget.text.data AS
data | eval x=mvzip(data,size)| mvexpand x | eval x = split(x,",") | eval
data=mvindex(x,0) | eval size=mvindex(x,1) | table _time,data, size

In the end the search created individual events, but there are always duplicates. When I use the same search without | spath | it seems to be correct, but I've no idea why.
Is there an important difference in the structure of my event?

Thanks in advance

Heinz

0 Karma

SplunkTrust
SplunkTrust

Hi HeinzWaescher,

looks like JSON data, have you tried the spath command on your event and do your stats after that?

hope this helps ...

cheers, MuS

Motivator

Hi MuS,

haven't heard about that command before, but it looks usefull for my problem. Thanks!

0 Karma