Having trouble reading complexed nested Json

[chrisboy68]

Hi, struggling trying to count objects in a big json doc. I'm on version 8.0.5, so function json_keys is not available. 

{
	"0": {
		"field1": "123"
	},
	"1": {
		"field2": "123"
	},
	"2": {
		"field3": "123"
	},
	"3": {
		"field4": "123"
	},
	"4": {
		"field5": "123"
	}


}

This is a sample, I am able to get down to the path (startpath) with spath. What I'm trying to do is count the instances of the objects (0,1,2,3,4). I can't cleanly regex backwards as the real values names are not consistent.   Thought I could do something like startpath{} and list them out , but the wildcards {} are not working anyway I try it. Thoughts, suggestions?

Thanks

Chris

[ITWhisperer]

Will this work for you?

| makeresults 
| eval _raw="{\"startpath\": {
    \"0\": {
        \"ID\": \"123\"
     },
     \"1\": {
        \"ID\": \"123\"
     },
     \"2\": {
        \"ID\": \"123\"
     },
     \"3\": {
        \"ID\": \"123\"
     },
     \"4\": {
        \"ID\": \"123\"
     },
     \"4\": {
      \"ID\": \"123\"
   }
}
}"
| spath
| foreach startpath.*.ID
    [| eval startpath_<<MATCHSEG1>>_count=mvcount('<<FIELD>>')]
| fields - startpath.*.*

[chrisboy68]

sorry, i made the sample too easy. I updated my sample json. No, I need to count the instance of the object. 

[ITWhisperer]

Simplifying doesn't always help - in this instance, your example is not valid JSON format. Please can you update the example with a valid, and possibly more representative example?

[chrisboy68]

Ok I updated. Just know that the sample is deeply nested and I can get to this object starting with an initial spath.

[ITWhisperer]

| makeresults 
| eval _raw="{
	\"0\": {
		\"field1\": \"123\"
	},
	\"1\": {
		\"field2\": \"123\"
	},
	\"2\": {
		\"field3\": \"123\"
	},
	\"3\": {
		\"field4\": \"123\"
	},
	\"4\": {
		\"field5\": \"123\"
	}


}"
| spath
| foreach *.*
    [| eval startpath_<<MATCHSEG1>>_count=mvcount('<<FIELD>>')]
| stats sum(startpath_*_count) as startpath_*_count

[ITWhisperer · Accepted solution]

| makeresults 
| eval _raw="{
	\"0\": {
		\"field1\": \"123\"
	},
	\"1\": {
		\"field2\": \"123\"
	},
	\"2\": {
		\"field3\": \"123\"
	},
	\"3\": {
		\"field4\": \"123\"
	},
	\"4\": {
		\"field5\": \"123\"
	}


}"
| spath
| foreach *.*
    [| eval startpath_count=if(isnull(startpath_count),mvcount('<<FIELD>>'),startpath_count+mvcount('<<FIELD>>'))]
| stats sum(startpath_count) as startpath_count

[chrisboy68]

Neat. Trying to follow. I need to have the total of all, not each count. So, in my example, the total is 5.

[chrisboy68]

I'm almost there. Now I need to count by each event, as this is totaling for every single event.  Looks like I just need to add a group by in the stats. Thank you!