Splunk Search

Search help - find total sum of lengths of array

ys2119
Loves-to-Learn

My current search returns a series of events like: 

{'field1' : {'field2' : [obj1, obj2, obj3]}}

{'field1' : {'field2' : [obj4, obj5]}}

{'field1' : {'field2' : [obj6]}}

 

I want to return the total sum of the lengths of the field1.field2 lists - in this case, would be 3 + 2 + 1 = 6

Can anyone help me with an easy way to do this? 

Labels (3)
0 Karma

somesoni2
Revered Legend

Are the fields (field1 and field2) already extracted?

0 Karma

ys2119
Loves-to-Learn

No, I just have the query (CURRENT_QUERY) that returns that list of events, but I still need to extract the inner list

And I think stats count(field1.field2) will get the length of the array..but not sure how to return a single number for the total sum of lengths

I also tried using spath like - spath output=myarray path=field1.field2{} but not sure what to do with it

0 Karma

somesoni2
Revered Legend

Can you list the name of fields (exact name) and sample values (output of simple search like "index=foo sourcetype=bar | head 1 | table field1 field1.field2{}")?

You can basically use "eval - split" on field2 by comma  (which will give a multivalued field) and then use mvcount function to get the count of values in the resulting multivalued field).

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...