How to extract count of specific event from nested JSON?

[chtmai]

I have this data coming in every minute to monitor application performance:

{ "events": [ 
     { "appId": "mock-app",
       "eventType": "WorkflowRequestFailedCount",
       "failureType": "wf.execution.error",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 15,
       "workflowId": "create"
     },
     { "appId": "mock-app",
       "eventType": "WorkflowRequestProcessedCount",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 0
     },
     { "appId": "mock-app",
       "eventType": "WorkflowRequestReceivedCount",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 20,
       "workflowId": "create"
     }
   ]
}

I need a query (to set up an alert) that identifies when throughput is GREATER than 0 for throughput nested with eventType = WorkflowRequestFailedCount. I can't figure out how to isolate the throughput count between different eventType items when they are both nested within the same events object as shown above.

For the JSON shown above, the correct query should trigger an alert because the throughput for WorkflowRequestFailedCount is 15 (greater than 0).

Appreciate the help.

[to4kawa]

your sample is not valid json.
Splunk can't extract invalid json.
We can't create a solution with the wrong sample.

[chtmai]

@to4kawa Updated! Does this help?

[to4kawa]

{ "events": [ 
     { "appId": "mock-app",
       "eventType": "WorkflowRequestFailedCount",
       "failureType": "wf.execution.error",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 15,
       "workflowId": "create"
     },
     { "appId": "mock-app",
       "eventType": "WorkflowRequestProcessedCount",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 0
     },
     { "appId": "mock-app",
       "eventType": "WorkflowRequestReceivedCount",
       "metricType": "COUNTER",
       "requestType": "WORKFLOW",
       "throughput": 20,
       "workflowId": "create"
     }
   ]
}

this is valid JSON. your JSON is not valid.

[chtmai]

@to4kawa Sorry! I was using the highlighted syntax mode in Splunk. Thanks for correcting that.

[to4kawa · Accepted solution]

| spath events{} output=events
| mvexpand events
| spath input=events
| fields - events* _raw
| search throughput > 0 AND eventType = WorkflowRequestFailedCount
| table *