Splunk Search

how to loop through json array based on expression and create counter

gpSplunk123
Engager

i'm hardcoding some data like names, where i will pass in a token in the future, to create a simple example of what i'm trying to achieve. I want to loop through all values, which has objects containing the data. Each field i loop through, i want to write an if statement to see if it matches what i'm expecting, if so increment the counter, else leave it the same. Here is my data and what i have so far, weird part is the match or even == doesn't work for me here. It should be at least 2 for sum, but nameTotal should have gotten that right at least? If i remove the stats (cause it loses my nameTotal field, nameTotal is always 0 meaning my if statement's never was true which means '<>' isn't right?, not sure what the variable is that i'm looking for from it.

index=myIndex latest=+5h "extraFields{}.aimId"="innersource" "extraFields{}.prData.prResponse.values{}.author.user.name"="f401950"
| eval nameTotal= 0
| foreach "extraFields{}.prData.prResponse.values{}.author.user.name"
[eval names=if(match('<<FIELD>>', "f401950"), nameTotal+1, nameTotal)]
| stats sum(names) as totalPrs
| table totalPrs, nameTotal

Results:
totalPrs | nameTotal
1 |

Sample of my data
alt text

0 Karma

to4kawa
Ultra Champion
index=myIndex latest=+5h "extraFields{}.aimId"="innersource" "extraFields{}.prData.prResponse.values{}.author.user.name"="f401950" 
| spath path=extraFields{}.prData.prResponse.values{}.author.user output=user
| stats count by user
| spath input=user

I see, how about this?

gpSplunk123
Engager

thanks! that worked really well!, is there a way i can append more columns based on a subsearch? cause i know stats loses my fields if it's not included in it. I don't want to add it as part of the "by" because it'll throw the data off. I just wanted to give more meta data based on the name, like gender, etc. Here's a snippet of what i was trying to achieve. I want to add name + email as part of the table's results, without modifying the results.

index=myIndex latest=+5h "extraFields{}.aimId"="innersource"  "extraFields{}.prData.prResponse.values{}.author.user.name"="*" 
| spath path=extraFields{}.prData.prResponse.values{}.author.user.name output=employeeId
| spath path=extraFields{}.prData.prResponse.values{}.author.user.displayName output=name
| spath path=extraFields{}.prData.prResponse.values{}.author.user.emailAddress output=email
| stats count by employeeId, name, email
| sort -count
0 Karma

to4kawa
Ultra Champion

check my updated answer.

0 Karma

gpSplunk123
Engager

that worked, thanks!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What is feather-light but cannot be held long?

May 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

.conf26 Registration is Live: Secure Your Early Bird Pass Now

  Lock in Your Spot: Registration Open for .conf26 in Denver Hello Splunkers, I have exciting news! Your ...

Mile High Learning with Splunk University, Denver, Colorado

If Denver is known for its mile-high elevation, Splunk University is about to raise the bar on technical ...