Splunk Search

Find the count of a specific field value in json array of objects.

nikitha15
Explorer

Hi i have a json data which i am working on and i used fieldsummary to get data similar to below image.

sample example:

suppose i have my result like this

Screenshot (38).png

I want to get count of value "Denver" in the field values from the above image. I tried spath but it's not working.

output  should be  like:

 

value        Count

Denver         1

 

 

Any help is appreciated. thanks.

Labels (2)
Tags (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @nikitha15 

Can you try this approach, you have to tune regex matching to your data.

| makeresults 
| eval value="[{\"name1\":\"val1\",\"count\":3},{\"name2\":\"val2\",\"count\":1}, {\"name3\":\"val3\",\"count\":2}]" 
| eval json_arrays=split(value,"},") 
| mvexpand json_arrays 
| rex field=json_arrays "\"(?<name>[^\"]+)\":\"(?<value>[^\"]+)\"\,\"count\":(?<count_val>\d+)" 
| table json_arrays name value count_val

Tried output,

venkatasri_0-1625748890304.png

---

An upvote would be appreciated and Accept solution if this reply helps!

View solution in original post

Tags (3)
0 Karma

nikitha15
Explorer

Thanks a ton. This worked.

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @nikitha15 

Can you try this approach, you have to tune regex matching to your data.

| makeresults 
| eval value="[{\"name1\":\"val1\",\"count\":3},{\"name2\":\"val2\",\"count\":1}, {\"name3\":\"val3\",\"count\":2}]" 
| eval json_arrays=split(value,"},") 
| mvexpand json_arrays 
| rex field=json_arrays "\"(?<name>[^\"]+)\":\"(?<value>[^\"]+)\"\,\"count\":(?<count_val>\d+)" 
| table json_arrays name value count_val

Tried output,

venkatasri_0-1625748890304.png

---

An upvote would be appreciated and Accept solution if this reply helps!

Tags (3)
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...