Troubling json extraction

[Cuyose]

I can't for the life of me figure this out. There seem to be examples all over and none of them address this.

I have a json element that looks like this.(I reduced the comma delimited elements to 2 for clarity, but there are dozens in the same format.
{"status":"success","data":{"11-01-00251":"88","11-01-00247":"378"}}

Splunk is displaying the event in structured json just fine in the event list. What I want to do is be able to report on this data. This is inventory. So the first data element is the sku, and the integer is the quantity. Basically how do I search to be able to do a

|chart inventory by sku?

[somesoni2]

This seems to work for me.

|stats count | eval _raw="{\"status\":\"success\",\"data\":{\"11-01-00251\":\"88\",\"11-01-00247\":\"378\"}}" | rex max_match=0 "\"(?[^\"]*)\":\"(?\d+)"

[aweitzman]

You're trying to get Splunk to interpret field names as field values, which isn't easy. You might be well served to rewrite the output (either at the source, or possibly via a transform) like so:

{"status":"success","data":[{"sku":"11-01-00251","inventory":"88"},{"sku":"11-01-00247","inventory":"378"}]}

Then you can work with it through spath using something like example 3 on the spath documentation page.

[aweitzman]

1. You might want to consider a method that does the string manipulation for a single unit of "data", and then using python's "join" command to put the results together the way you want. (I don't really know python, but that seems to be how it ought to work based on what I found on the internet.)

2. Since you're adding it in as text, you might want to avoid naming the second field "count" since that's also a Splunk command.

[Cuyose]

Thats what Im resorting to, I have a python script to do it and it's all done except for the little part where its adding a comma on the last data object invalidating the json.

for sku in data:
print '{"sku":"'+ sku + '","count":"' + str(data[sku]) + '"},'

[Cuyose]

Maybe even a regex that can extract this would be useful, Splunk's field extraction can't seem to figure it out.