Splunk Search

How to extract count of specific event from nested JSON?

chtmai
Explorer

I have this data coming in every minute to monitor application performance:

 

 

{ "events": [ 
     { "appId": "mock-app",
       "eventType": "WorkflowRequestFailedCount",
       "failureType": "wf.execution.error",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 15,
       "workflowId": "create"
     },
     { "appId": "mock-app",
       "eventType": "WorkflowRequestProcessedCount",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 0
     },
     { "appId": "mock-app",
       "eventType": "WorkflowRequestReceivedCount",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 20,
       "workflowId": "create"
     }
   ]
}

 

 

I need a query (to set up an alert) that identifies when throughput is GREATER than 0 for throughput nested with eventType = WorkflowRequestFailedCount. I can't figure out how to isolate the throughput count between different eventType items when they are both nested within the same events object as shown above.

For the JSON shown above, the correct query should trigger an alert because the throughput for WorkflowRequestFailedCount is 15 (greater than 0).

Appreciate the help.

Labels (1)
0 Karma
1 Solution

to4kawa
SplunkTrust
SplunkTrust

| spath events{} output=events
| mvexpand events
| spath input=events
| fields - events* _raw
| search throughput > 0 AND eventType = WorkflowRequestFailedCount
| table *

View solution in original post

to4kawa
SplunkTrust
SplunkTrust

your sample is not valid json.
Splunk can't extract invalid json.
We can't create a solution with the wrong sample.

0 Karma

chtmai
Explorer

@to4kawa Updated! Does this help?

0 Karma

to4kawa
SplunkTrust
SplunkTrust
{ "events": [ 
     { "appId": "mock-app",
       "eventType": "WorkflowRequestFailedCount",
       "failureType": "wf.execution.error",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 15,
       "workflowId": "create"
     },
     { "appId": "mock-app",
       "eventType": "WorkflowRequestProcessedCount",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 0
     },
     { "appId": "mock-app",
       "eventType": "WorkflowRequestReceivedCount",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 20,
       "workflowId": "create"
     }
   ]
}

this is valid JSON. your JSON is not valid.

chtmai
Explorer

@to4kawa Sorry! I was using the highlighted syntax mode in Splunk. Thanks for correcting that.

0 Karma

to4kawa
SplunkTrust
SplunkTrust

| spath events{} output=events
| mvexpand events
| spath input=events
| fields - events* _raw
| search throughput > 0 AND eventType = WorkflowRequestFailedCount
| table *

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!