Get the Boolean value count for each field

[akthota]

Hello Community,

I have a sample data as below:

2023-10-17T17:14:24,436Z client-id=1159222917, transaction-id=522f4012-9737-483c-a3bb-8f23f146da0f [INFO ] [http-nio-9010-exec-3] c.c.a.s.AService AddressMetrics: {"fieldsToCompare":["addressLine1","city","stateProvince","postalCode","latitude","longitude","taxGeoCode","matchCode","locationCode"],"addressResponseV1":{"addresses":[{"taxGeoCode":"442150950","apartmentLabel":"","matchCode":"S80","city":"EDINBURG","postalCode":"785413355","latitude":"26.307701","houseNumber":"121","stateProvince":"TX","leadingDirectional":"W","streetName":"VAN WEEK","lastLine":"EDINBURG, TX 78541-3355","addressLine1":"121 W VAN WEEK ST","addressLine2":"","streetSuffix":"ST","locationCode":"AP05","trailingDirectional":"","longitude":"-98.162231","apartmentNumber":""}]},"addressRequest":{"clientId":"1159222917","city":"EDINBURG","postalCode":"78541","multiMatch":false,"addressLine1":"121 W VAN WEEK ST","addressLine2":"","state":"TX","sessionId":"1159222917","userId":"1366654994","transactionId":"522f4012-9737-483c-a3bb-8f23f146da0f"},"addressResponseV2":{"addresses":[{"geoResultCode":"S8HPNTSCZA","zipCode":"78541","taxGeoCode":"442150950","matchCode":"S80","city":"EDINBURG","latitude":26.307701,"addressLine1":"121 W VAN WEEK ST","zip4":"3355","addressLine2":"","state":"TX","locationCode":"AP05","longitude":-98.162231}]},"decisionMatrix":{"taxGeoCode":true,"matchCode":true,"city":true,"postalCode":true,"latitude":true,"addressLine1":true,"stateProvince":true,"locationCode":true,"longitude":false}}

2023-10-17T17:14:24,432Z client-id=0122346633, transaction-id=1fde5a12-ee65-4523-bed4-c8dd76cc666b [INFO ] [http-nio-9010-exec-6] c.c.a.s.AService AddressMetrics: {"fieldsToCompare":["addressLine1","city","stateProvince","postalCode","latitude","longitude","taxGeoCode","matchCode","locationCode"],"addressResponseV1":{"addresses":[{"taxGeoCode":"442152020","apartmentLabel":"","matchCode":"S80","city":"MISSION","postalCode":"785741749","latitude":"26.240278","houseNumber":"1004","stateProvince":"TX","leadingDirectional":"E","streetName":"DAWSON","lastLine":"MISSION, TX 78574-1749","addressLine1":"1004 E DAWSON LN","addressLine2":"","streetSuffix":"LN","locationCode":"AP05","trailingDirectional":"","longitude":"-98.310512","apartmentNumber":""}]},"addressRequest":{"clientId":"0122346633","city":"MISSION","postalCode":"78574","multiMatch":false,"addressLine1":"1004 E DAWSON LN","addressLine2":"","state":"TX","sessionId":"0122346633","userId":"0867774533","transactionId":"1fde5a12-ee65-4523-bed4-c8dd76cc666b"},"addressResponseV2":{"addresses":[{"geoResultCode":"S8HPNTSCZA","zipCode":"78574","taxGeoCode":"442152020","matchCode":"S80","city":"MISSION","latitude":26.240278,"addressLine1":"1004 E DAWSON LN","zip4":"1749","addressLine2":"","state":"TX","locationCode":"AP05","longitude":-98.310512}]},"decisionMatrix":{"taxGeoCode":false,"matchCode":true,"city":false,"postalCode":true,"latitude":true,"addressLine1":true,"stateProvince":true,"locationCode":true,"longitude":true}}

what I am trying to achieve here is get the stats of each field within the decisionMatrix object as below:

Field	TRUE	FALSE
taxGeoCode	1	1
matchCode	2	0
city	1	1

Any suggestions?

[gcusello]

Hi @akthota ,

you could try sometthing like this:

<your_search>
| rex "\{\"taxGeoCode\":(?<taxGeoCode>[^,]*),\"matchCode":(?<matchCode>[^,]*),"city":(?<city>[^,]*),"
| eval cond=if(taxGeoCode="true" OR matchCode="true" OR city="true","true","false")
| stats 
   count(eval(taxGeoCode IN ("true","false")) AS taxGeoCode 
   count(eval(matchCode IN ("true","false")) AS matchCode 
   count(eval(city IN ("true","false")) AS city
| by cond

you could also use the spath command (better), in this case, you have to change the field names in the stats command.

Ciao.

Giuseppe