Splunk Search

How to count the size of json array of a single event

wood1986
Explorer

How to count the size of json array of a single event

For example {"a" : [{"b": true}, {"b": true}, {"c": true}]}

name   size
===========
a      3
Tags (3)
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

You can use the spath command.

your_search | spath path=a{} output=name | stats count(name) as name

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath

View solution in original post

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

You can use the spath command.

your_search | spath path=a{} output=name | stats count(name) as name

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

your_search | spath path=a{} output=aName | spath path=z{} output=zName | stats count(aName) as a count(zName) as z by id

0 Karma

wood1986
Explorer

my example is too simple. for a single event
{"id": 32413
"a" : [{"b": true}, {"b": true}, {"c": true}].
"z" : [{"a": 1}, {"d":2}]}

I want this output

id    a    z
=============
32413  3    2
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...