Splunk Search

Having trouble writing a group by query

haqkap
New Member

Here's the issue, my data is in JSON Format (see example below).

Each event that I have is associated with a user_id and has an array of assignments. Each assignment has an associated content_object_id, that is not unique, and scoring data.

I need to do figure out averages based on the student's scoring data. So my first query works well:

source="xyz.json" | stats avg(assignments{}.scoring_data.scoredPoints) by user_id

What I'm having trouble with is taking one step down and grouping the scoring data based on content_object_id for each user_id. These content_object_ids represent a specific sub-lesson.
So at the end what I'd like to see is a break down of a students average score, grouped by content_object_id.

I've tried this:

source="xyz.json" | stats avg(assignments{}.scoring_data.scoredPoints) as Average by user_id | FIELDS username, Average

But didn't work.

Here's the JSON:

Event 1:

 user_id: 1234
 assignments : [
{[-]
  content_object_id : 1,
  scoring_data : {scoredPoints:1},    
  ]

  content_object_id : 1,
  scoring_data : {scoredPoints:1},    
  ]

  content_object_id : 2,
  scoring_data : {scoredPoints:1},    
  ]

  content_object_id : 2,
  scoring_data : {scoredPoints:0},    
  ]}

Event 2:

user_id: 5678
assignments : [
{[-]
  content_object_id : 1,
  scoring_data : {scoredPoints:1},    
  ]

  content_object_id : 1,
  scoring_data : {scoredPoints:1},    
  ]

  content_object_id : 2,
  scoring_data : {scoredPoints:0},    
  ]

  content_object_id : 2,
  scoring_data : {scoredPoints:0},    
  ]}
Tags (1)
0 Karma

_d_
Splunk Employee
Splunk Employee

Try using chart instead:

my_search_here | chart avg(measure) over user_id by object_id

d.

Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...