Splunk Search

Find the count of a specific field value in json array of objects.

nikitha15
Explorer

Hi i have a json data which i am working on and i used fieldsummary to get data similar to below image.

sample example:

suppose i have my result like this

Screenshot (38).png

I want to get count of value "Denver" in the field values from the above image. I tried spath but it's not working.

output  should be  like:

 

value        Count

Denver         1

 

 

Any help is appreciated. thanks.

Labels (2)
Tags (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @nikitha15 

Can you try this approach, you have to tune regex matching to your data.

| makeresults 
| eval value="[{\"name1\":\"val1\",\"count\":3},{\"name2\":\"val2\",\"count\":1}, {\"name3\":\"val3\",\"count\":2}]" 
| eval json_arrays=split(value,"},") 
| mvexpand json_arrays 
| rex field=json_arrays "\"(?<name>[^\"]+)\":\"(?<value>[^\"]+)\"\,\"count\":(?<count_val>\d+)" 
| table json_arrays name value count_val

Tried output,

venkatasri_0-1625748890304.png

---

An upvote would be appreciated and Accept solution if this reply helps!

View solution in original post

Tags (3)
0 Karma

nikitha15
Explorer

Thanks a ton. This worked.

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @nikitha15 

Can you try this approach, you have to tune regex matching to your data.

| makeresults 
| eval value="[{\"name1\":\"val1\",\"count\":3},{\"name2\":\"val2\",\"count\":1}, {\"name3\":\"val3\",\"count\":2}]" 
| eval json_arrays=split(value,"},") 
| mvexpand json_arrays 
| rex field=json_arrays "\"(?<name>[^\"]+)\":\"(?<value>[^\"]+)\"\,\"count\":(?<count_val>\d+)" 
| table json_arrays name value count_val

Tried output,

venkatasri_0-1625748890304.png

---

An upvote would be appreciated and Accept solution if this reply helps!

Tags (3)
0 Karma
Get Updates on the Splunk Community!

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...

New This Month in Splunk Observability Cloud - Synthetic Monitoring updates, UI ...

This month, we’re delivering several platform, infrastructure, application and digital experience monitoring ...