Splunk Search

How to count the number of event based on JSON field structure/keys in Splunk

samgol
New Member

I want to count the number of occurrence of a specific JSON structure. For example in my event there is a field called data which its value is JSON . but this field can have a variety of structures. like:

data = {a: "b"}
data= {d: "x", h: "e"}

 

now I want to know how many event has data with each JSON structure and I don't care about values only keys are matter.  So I want to count JSON that has similar keys.

Labels (4)
0 Karma

tscroggins
Influencer

@samgol 

You can get an approximate count by JSON key schema using something like this:

| fields data
| spath input=data
| fields - data
| foreach * [ eval <<FIELD>>="" ]
| fieldsummary
| fields field count
| mvcombine field

Note that two schemas with the same field counts will be combined into a single set.

Another possibility is removing values and normalizing them to "" in data before grouping:

| eval data=replace(data, "\" ?: ?(?:\"(?:\\\"|.*?)\"|[-\d\.eE]+)", "\":\"\"")
| stats count by data

{"a": "b"} => {"a":""}
{"d": "x", "h": "e"} => {"d":"", "h":""}

data    count
{"a":""}    1
{"d":"", "h":""}    1

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...