Splunk Search

How I can use the rename command in my search on JSON data?

rupesh_patil20
Path Finder

Hi.. I have json data such as

{"result": 
   [
    {"EventData.mlsnumber": "1039455", "result": 1}, 
    {"EventData.mlsnumber": "1189814", "result": 1}, 
    {"EventData.mlsnumber": "1218148", "result": 1}, 
    {"EventData.mlsnumber": "1247031", "result": 4}, 
    {"EventData.mlsnumber": "1290591", "result": 1}, 
    {"EventData.mlsnumber": "4629170", "result": 1}, 
    {"EventData.mlsnumber": "4629729", "result": 1}, 

   ]
}

I want to display EventData.mlsnumber in an MLS_Number column and result in a Count column. I have gone through this website http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/spath but did not get any single output.
For your information, I am getting the result from the REST API into the Splunk search. Can you please help me with the search?
The search started as: source="rest://mls_number" which gives results when I perform search, so what should I add after that?

Thanks!!

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

So a simple rename will work.

source="rest://mls_number" | rename result{}.EventData.mlsnumber AS MLS_Number result{}.result AS Count

But, a caveat here is that the fields are multivalue and won't expand correctly. when you try to do stats on the mls numbers.
So after the search above, do this:

eval atmp = mvzip(MLS_Number,Count) | mvexpand atmp | eval a=split(atmp,",")|eval Count = mvindex(a,1)|eval MLS_Number=mvindex(a,0) | <other stats>

The other stats will allow you to do time based calculations by MLS_Number.

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

So a simple rename will work.

source="rest://mls_number" | rename result{}.EventData.mlsnumber AS MLS_Number result{}.result AS Count

But, a caveat here is that the fields are multivalue and won't expand correctly. when you try to do stats on the mls numbers.
So after the search above, do this:

eval atmp = mvzip(MLS_Number,Count) | mvexpand atmp | eval a=split(atmp,",")|eval Count = mvindex(a,1)|eval MLS_Number=mvindex(a,0) | <other stats>

The other stats will allow you to do time based calculations by MLS_Number.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...