Given below is a snippet of splunk event. My requirement is to find all the occurrences of "isOutstanding": true. Here the point to note is that one event may/may not have multiple occurrences. Need to find the total count from multiple events over a period of time.
{ \"school\": { \"schoolId\": \"1\", \"schoolName\": \"SchoolX\", \"schoolType\": \"private\", \"students\": [ { \"id\": \"1\", \"isOutstanding\": true, }, { \"id\": \"2\", \"isOutstanding\": false, }, { \"id\": \"3\", \"isOutstanding\": false, } ] } }
The below Splunk query index=myIndex "isOutstanding":true gives the count of events having "isOutstanding": true. But it doesn't consider the count of multiple occurrences in one event. How can I get the count of all the occourences in an event? TIA
Depending on whether your actual event has the backslashes, try this
| rex max_match=0 "(?<isOutstanding>isOutstanding\\\\\":\s+true)"
| eval count = mvcount(isOutstanding)
| stats sum(count) as total
This was helpful but didn't exactly serve my requirement. Has to change a little bit for the final working query
| rex max_match=0 "(?<isOutstanding>isOutstanding\\\\\":true)" | stats count(isOutstanding) as total
Use rex to extract the 'isOutstanding' texts and mvcount to count them.
| rex max_match=0 "(?<isOutstanding>isOutstanding)"
| eval count = mvcount(isOutstanding)
@richgalloway @ITWhisperer If I remember correctly, simple stats count over a single field takes into account mvfields.