Splunk Search

How to extract field names from an object or nested JSON field?

SwervyMcBourbon
Engager

For these following two events:

 

 

{
  "people": {
    "bob": 172,
    "maria": 161
  }
}

{
  "people": {
    "bob": 172,
    "garth": 180
  }
}

 

 

 
I want to report the number of occurrences of each person's name in the "people" object (the field name itself, not its value).  The desired result of my query against the two events above would be:

 

 

bob: 2
maria: 1
garth: 1

 

 

 

What SPL syntax/commands could I use to achieve this?  I have tried a variety of things online to no avail.

 

 

Labels (5)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

See if this helps.

<<your search for people events>>
| spath
```Loop over the people object and make a list of each name found```
| foreach people.* [ eval name=mvappend(name,if(isnotnull('<<FIELD>>'),"<<MATCHSTR>>", null()))]
```Break the name list into separate events```
| mvexpand name
```Count the names```
| stats count by name
---
If this reply helps you, Karma would be appreciated.

View solution in original post

SwervyMcBourbon
Engager

This worked like a charm, thank you @richgalloway !

richgalloway
SplunkTrust
SplunkTrust

See if this helps.

<<your search for people events>>
| spath
```Loop over the people object and make a list of each name found```
| foreach people.* [ eval name=mvappend(name,if(isnotnull('<<FIELD>>'),"<<MATCHSTR>>", null()))]
```Break the name list into separate events```
| mvexpand name
```Count the names```
| stats count by name
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...