Splunk Search

mvzip json array of values in one event

exocore123
Path Finder
[  
   {  
      "sym":"ee",
      "code":2E1,
   },
   {  
      "sym":"ie",
      "code":2E2,
   }
]

I have a field call errorData, when I use spath to access the json and do stats and mvzip(sym,code) function, it splits these events into two different events (but it is still not really what I want). How can I keep it into one event with the contents aggregated. Sometimes the array also only has 1 element, so it should be viable for that situation too

sym                     code                       count
ee,ie                 2E1,2E2                       1
ee                      2E2                         1

And I do not want the json with single element array to over-count, I mean mistakenly count matching in the multiple elements json.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

index=index | spath input=errorMsg path={}.sym output=sym | spath input=errorMsg path={}.code output=code | nomv sym | nomv code | stats count by sym code
0 Karma

exocore123
Path Finder

Wow... that was so much easier than I thought, is there a way I can introduce a comma within the space? Using rex or makedelim or join maybe?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can do like this (assuming the value of sym and code do not contain spaces on their own.

above search
| eval sym=replace(sym," ",", ") | eval code=replace(code," ",", ")
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Can you provide your current full search that you're using?

0 Karma

exocore123
Path Finder

index=index | spath input=errorMsg path={}.sym output=sym | spath input=errorMsg path={}.code output=code | stats count by sym, code

0 Karma

exocore123
Path Finder

Or eval msg=mvzip(sym, code) | stats count by msg would get me two events listed instead of 4 like above

0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...