Splunk Search

Find the count of a specific field value in json array of objects.

nikitha15
Explorer

Hi i have a json data which i am working on and i used fieldsummary to get data similar to below image.

sample example:

suppose i have my result like this

Screenshot (38).png

I want to get count of value "Denver" in the field values from the above image. I tried spath but it's not working.

output  should be  like:

 

value        Count

Denver         1

 

 

Any help is appreciated. thanks.

Labels (2)
Tags (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @nikitha15 

Can you try this approach, you have to tune regex matching to your data.

| makeresults 
| eval value="[{\"name1\":\"val1\",\"count\":3},{\"name2\":\"val2\",\"count\":1}, {\"name3\":\"val3\",\"count\":2}]" 
| eval json_arrays=split(value,"},") 
| mvexpand json_arrays 
| rex field=json_arrays "\"(?<name>[^\"]+)\":\"(?<value>[^\"]+)\"\,\"count\":(?<count_val>\d+)" 
| table json_arrays name value count_val

Tried output,

venkatasri_0-1625748890304.png

---

An upvote would be appreciated and Accept solution if this reply helps!

View solution in original post

Tags (3)
0 Karma

nikitha15
Explorer

Thanks a ton. This worked.

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @nikitha15 

Can you try this approach, you have to tune regex matching to your data.

| makeresults 
| eval value="[{\"name1\":\"val1\",\"count\":3},{\"name2\":\"val2\",\"count\":1}, {\"name3\":\"val3\",\"count\":2}]" 
| eval json_arrays=split(value,"},") 
| mvexpand json_arrays 
| rex field=json_arrays "\"(?<name>[^\"]+)\":\"(?<value>[^\"]+)\"\,\"count\":(?<count_val>\d+)" 
| table json_arrays name value count_val

Tried output,

venkatasri_0-1625748890304.png

---

An upvote would be appreciated and Accept solution if this reply helps!

Tags (3)
0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...