Splunk Search

How to extract count of specific event from nested JSON?

chtmai
Explorer

I have this data coming in every minute to monitor application performance:

 

 

{ "events": [ 
     { "appId": "mock-app",
       "eventType": "WorkflowRequestFailedCount",
       "failureType": "wf.execution.error",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 15,
       "workflowId": "create"
     },
     { "appId": "mock-app",
       "eventType": "WorkflowRequestProcessedCount",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 0
     },
     { "appId": "mock-app",
       "eventType": "WorkflowRequestReceivedCount",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 20,
       "workflowId": "create"
     }
   ]
}

 

 

I need a query (to set up an alert) that identifies when throughput is GREATER than 0 for throughput nested with eventType = WorkflowRequestFailedCount. I can't figure out how to isolate the throughput count between different eventType items when they are both nested within the same events object as shown above.

For the JSON shown above, the correct query should trigger an alert because the throughput for WorkflowRequestFailedCount is 15 (greater than 0).

Appreciate the help.

Labels (1)
0 Karma
1 Solution

to4kawa
Ultra Champion

| spath events{} output=events
| mvexpand events
| spath input=events
| fields - events* _raw
| search throughput > 0 AND eventType = WorkflowRequestFailedCount
| table *

View solution in original post

to4kawa
Ultra Champion

your sample is not valid json.
Splunk can't extract invalid json.
We can't create a solution with the wrong sample.

0 Karma

chtmai
Explorer

@to4kawa Updated! Does this help?

0 Karma

to4kawa
Ultra Champion
{ "events": [ 
     { "appId": "mock-app",
       "eventType": "WorkflowRequestFailedCount",
       "failureType": "wf.execution.error",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 15,
       "workflowId": "create"
     },
     { "appId": "mock-app",
       "eventType": "WorkflowRequestProcessedCount",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 0
     },
     { "appId": "mock-app",
       "eventType": "WorkflowRequestReceivedCount",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 20,
       "workflowId": "create"
     }
   ]
}

this is valid JSON. your JSON is not valid.

chtmai
Explorer

@to4kawa Sorry! I was using the highlighted syntax mode in Splunk. Thanks for correcting that.

0 Karma

to4kawa
Ultra Champion

| spath events{} output=events
| mvexpand events
| spath input=events
| fields - events* _raw
| search throughput > 0 AND eventType = WorkflowRequestFailedCount
| table *

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...