Splunk Search

how to loop through json array based on expression and create counter

gpSplunk123
Engager

i'm hardcoding some data like names, where i will pass in a token in the future, to create a simple example of what i'm trying to achieve. I want to loop through all values, which has objects containing the data. Each field i loop through, i want to write an if statement to see if it matches what i'm expecting, if so increment the counter, else leave it the same. Here is my data and what i have so far, weird part is the match or even == doesn't work for me here. It should be at least 2 for sum, but nameTotal should have gotten that right at least? If i remove the stats (cause it loses my nameTotal field, nameTotal is always 0 meaning my if statement's never was true which means '<>' isn't right?, not sure what the variable is that i'm looking for from it.

index=myIndex latest=+5h "extraFields{}.aimId"="innersource" "extraFields{}.prData.prResponse.values{}.author.user.name"="f401950"
| eval nameTotal= 0
| foreach "extraFields{}.prData.prResponse.values{}.author.user.name"
[eval names=if(match('<<FIELD>>', "f401950"), nameTotal+1, nameTotal)]
| stats sum(names) as totalPrs
| table totalPrs, nameTotal

Results:
totalPrs | nameTotal
1 |

Sample of my data
alt text

0 Karma

to4kawa
Ultra Champion
index=myIndex latest=+5h "extraFields{}.aimId"="innersource" "extraFields{}.prData.prResponse.values{}.author.user.name"="f401950" 
| spath path=extraFields{}.prData.prResponse.values{}.author.user output=user
| stats count by user
| spath input=user

I see, how about this?

gpSplunk123
Engager

thanks! that worked really well!, is there a way i can append more columns based on a subsearch? cause i know stats loses my fields if it's not included in it. I don't want to add it as part of the "by" because it'll throw the data off. I just wanted to give more meta data based on the name, like gender, etc. Here's a snippet of what i was trying to achieve. I want to add name + email as part of the table's results, without modifying the results.

index=myIndex latest=+5h "extraFields{}.aimId"="innersource"  "extraFields{}.prData.prResponse.values{}.author.user.name"="*" 
| spath path=extraFields{}.prData.prResponse.values{}.author.user.name output=employeeId
| spath path=extraFields{}.prData.prResponse.values{}.author.user.displayName output=name
| spath path=extraFields{}.prData.prResponse.values{}.author.user.emailAddress output=email
| stats count by employeeId, name, email
| sort -count
0 Karma

to4kawa
Ultra Champion

check my updated answer.

0 Karma

gpSplunk123
Engager

that worked, thanks!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...