Splunk Search

Find the count of a specific field value in json array of objects.

nikitha15
Explorer

Hi i have a json data which i am working on and i used fieldsummary to get data similar to below image.

sample example:

suppose i have my result like this

Screenshot (38).png

I want to get count of value "Denver" in the field values from the above image. I tried spath but it's not working.

output  should be  like:

 

value        Count

Denver         1

 

 

Any help is appreciated. thanks.

Labels (2)
Tags (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @nikitha15 

Can you try this approach, you have to tune regex matching to your data.

| makeresults 
| eval value="[{\"name1\":\"val1\",\"count\":3},{\"name2\":\"val2\",\"count\":1}, {\"name3\":\"val3\",\"count\":2}]" 
| eval json_arrays=split(value,"},") 
| mvexpand json_arrays 
| rex field=json_arrays "\"(?<name>[^\"]+)\":\"(?<value>[^\"]+)\"\,\"count\":(?<count_val>\d+)" 
| table json_arrays name value count_val

Tried output,

venkatasri_0-1625748890304.png

---

An upvote would be appreciated and Accept solution if this reply helps!

View solution in original post

Tags (3)
0 Karma

nikitha15
Explorer

Thanks a ton. This worked.

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @nikitha15 

Can you try this approach, you have to tune regex matching to your data.

| makeresults 
| eval value="[{\"name1\":\"val1\",\"count\":3},{\"name2\":\"val2\",\"count\":1}, {\"name3\":\"val3\",\"count\":2}]" 
| eval json_arrays=split(value,"},") 
| mvexpand json_arrays 
| rex field=json_arrays "\"(?<name>[^\"]+)\":\"(?<value>[^\"]+)\"\,\"count\":(?<count_val>\d+)" 
| table json_arrays name value count_val

Tried output,

venkatasri_0-1625748890304.png

---

An upvote would be appreciated and Accept solution if this reply helps!

Tags (3)
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...