Splunk Search

How do I count fields inside a JSON array

jwhughes58
Contributor

Hi,

I have this data

{"quarantineFolder": null, "spamScore": 100, "threatsInfoMap": [{"campaignID": null, "threat": "http://weg-aus-dem-hamsterrad.de/r5romlp/verif.myacc.resourses.biz/", "threatUrl": "https://threatinsight.proofpoint.com/cac61cbd-474f-77be-4915-2f27623219e4/threat/email/38e20c3d0a5c30dae9cc53f0fb77099a536a879530d4ded89209eb68db8be620", "classification": "malware", "threatType": "url", "threatID": "38e20c3d0a5c30dae9cc53f0fb77099a536a879530d4ded89209eb68db8be620", "threatTime": "2019-03-21T19:36:06.000Z", "threatStatus": "active"}], "replyToAddress": [], "phishScore": 0, "eventType": "messagesBlocked", "toAddresses": [“xyzzy@company.com”], "policyRoutes": ["default_inbound", "Inbound"], "messageParts": [{"md5": "4e12ab62f710e02270e02fdfad9a1817", "oContentType": "text/plain", "contentType": "text/plain", "disposition": "inline", "sha256": "d97d9261a6f0795bec34f055b997b01ec5f02b71f28d71aa88da47883c6df023", "sandboxStatus": null, "filename": "text.txt"}, {"md5": "fddffa81e7b4fe62073e0aab0336af76", "oContentType": "text/html", "contentType": "text/html", "disposition": "inline", "sha256": "43649abeaa49d66a1f4c36577251fd0578d6852c867d6fa4d3c26155eede56b0", "sandboxStatus": null, "filename": "text.html"}], "fromAddress": [], "QID": "2rbvw7q840-1", "xmailer": null, "senderIP": “1.1.1.1”, "sender": “plugh@company2.com”, "quarantineRule": null, "ccAddresses": [], "completelyRewritten": false, "messageTime": "2019-03-21T19:36:03.000Z", "recipient": [“xyzzy@company.com”], "messageSize": 3892, "headerReplyTo": null, "modulesRun": ["access", "smtpsrv", "av", "zerohour", "spf", "dkimv", "sandbox", "spam", "dmarc", "pdr", "urldefense"], "cluster": “prod_host”, "impostorScore": 0.0, "headerFrom": “Narf <narf@company.com> <plugh@company2.com>”, "GUID": "V-5swmMYZHoDpbgyPsQ9tN9LtKfCwHUK", "malwareScore": 100, "messageID": "<8TJjwegKPa6rThF30mDqDCkVzV36CA8OoaMbImztyGguX8SRF7d@kp.org>", "subject": “Narf Transaction for your invoice"}

I'm seeing an issue where the sender value isn't extracted if the number of items in the threatsInfoMap is large. Does someone have a suggestion for counting the items in the threatsInfoMap so I can see if this is what is happening?

TIA,
Joe

0 Karma
1 Solution

jwhughes58
Contributor

My co-worker finally got enough time to look at this for me. The solution is

| spath threatsInfoMap{} output=threatsElements
| stats count(threatsElements) AS threatsElementsCount by _time

View solution in original post

0 Karma

jwhughes58
Contributor

My co-worker finally got enough time to look at this for me. The solution is

| spath threatsInfoMap{} output=threatsElements
| stats count(threatsElements) AS threatsElementsCount by _time

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...