Splunk Search

How to extract count of specific event from nested JSON?

chtmai
Explorer

I have this data coming in every minute to monitor application performance:

 

 

{ "events": [ 
     { "appId": "mock-app",
       "eventType": "WorkflowRequestFailedCount",
       "failureType": "wf.execution.error",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 15,
       "workflowId": "create"
     },
     { "appId": "mock-app",
       "eventType": "WorkflowRequestProcessedCount",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 0
     },
     { "appId": "mock-app",
       "eventType": "WorkflowRequestReceivedCount",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 20,
       "workflowId": "create"
     }
   ]
}

 

 

I need a query (to set up an alert) that identifies when throughput is GREATER than 0 for throughput nested with eventType = WorkflowRequestFailedCount. I can't figure out how to isolate the throughput count between different eventType items when they are both nested within the same events object as shown above.

For the JSON shown above, the correct query should trigger an alert because the throughput for WorkflowRequestFailedCount is 15 (greater than 0).

Appreciate the help.

Labels (1)
0 Karma
1 Solution

to4kawa
Ultra Champion

| spath events{} output=events
| mvexpand events
| spath input=events
| fields - events* _raw
| search throughput > 0 AND eventType = WorkflowRequestFailedCount
| table *

View solution in original post

to4kawa
Ultra Champion

your sample is not valid json.
Splunk can't extract invalid json.
We can't create a solution with the wrong sample.

0 Karma

chtmai
Explorer

@to4kawa Updated! Does this help?

0 Karma

to4kawa
Ultra Champion
{ "events": [ 
     { "appId": "mock-app",
       "eventType": "WorkflowRequestFailedCount",
       "failureType": "wf.execution.error",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 15,
       "workflowId": "create"
     },
     { "appId": "mock-app",
       "eventType": "WorkflowRequestProcessedCount",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 0
     },
     { "appId": "mock-app",
       "eventType": "WorkflowRequestReceivedCount",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 20,
       "workflowId": "create"
     }
   ]
}

this is valid JSON. your JSON is not valid.

chtmai
Explorer

@to4kawa Sorry! I was using the highlighted syntax mode in Splunk. Thanks for correcting that.

0 Karma

to4kawa
Ultra Champion

| spath events{} output=events
| mvexpand events
| spath input=events
| fields - events* _raw
| search throughput > 0 AND eventType = WorkflowRequestFailedCount
| table *

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...