How to check if a nested json object is present or not in the splunk record

[ravi_lookout]

I have a few records in the splunk like this

{"timeStamp":"2025-04-21T08:21:40.000Z","eventId":"test_eventId_1","orignId":"test_originId_1","tenantId":"test_tenantId","violation_stats":{"Key1":11,"Key2":23,"Key3":1,"Key4":1,"Key5":1},"lastModifier":"test_admin","rawEventType":"test_event"}

{"timeStamp":"2025-04-21T08:21:40.000Z","eventId":"test_eventId_2","orignId":"test_originId_2","tenantId":"test_tenantId","violation_stats":{"Key1":1,"Key10":1},"lastModifier":"test_admin","rawEventType":"test_event"}

{"timeStamp":"2025-04-21T08:21:40.000Z","eventId":"test_eventId_3","orignId":"test_originId_3","tenantId":"test_tenantId","violation_stats":{"Key6":1,"Key7":2,"Key8":1,"Key9":4},"lastModifier":"test_admin","rawEventType":"test_event"}

{"timeStamp":"2025-04-21T08:21:40.000Z","eventId":"test_eventId_4","orignId":"test_originId_4","tenantId":"test_tenantId","lastModifier":"test_admin","rawEventType":"test_event"}

Now, I need to check how many records contain the violation_stats field and how many do not.

I tried the below query, but it didn't work

index="my_index" | search violation_stats{}=*

I checked online and got to know that I might need to use spath. However, since the keys inside the json are not static, I am not sure how I can use spath for my result.

[ITWhisperer · Accepted solution]

| spath violation_stats output=violation_stats
| where isnotnull(violation_stats)

[ravi_lookout]

This worked well @ITWhisperer . Thanks for the quick turnaround