Splunk Search

How do we count the fields inside a JSON array?

yahoohunk
Explorer

Each log entry contains some json. There is a field that is an array. I want to count the items in that array.

Example json data
{
"field1": "sample",
"messages": [
"noop",
"missing",
"error",
"unknown"
]
}

We've tried index="test_index" | spath input=log | regex id = "a|b" | stats count(messages)

Our desired output is something like:
id message count
a noop 5
a error 8

Tags (3)
0 Karma
1 Solution

yahoohunk
Explorer

Thanks for the suggestion martin_mueller. We got what we wanted by using the following.

index="test_index" | spath input=log
| regex templateId = "10|15"
| stats count(eval(source == "mail")) AS COUNT by id,messages{}

View solution in original post

0 Karma

yahoohunk
Explorer

Thanks for the suggestion martin_mueller. We got what we wanted by using the following.

index="test_index" | spath input=log
| regex templateId = "10|15"
| stats count(eval(source == "mail")) AS COUNT by id,messages{}

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Assuming the array was extracted by the spath into the field messages{}, you can do this:

... | spath input=log | rename messages{} as messages | eval message_count = mvcount(messages) | stats sum(message_count)
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...