Splunk Search

mvzip json array of values in one event

exocore123
Path Finder
[  
   {  
      "sym":"ee",
      "code":2E1,
   },
   {  
      "sym":"ie",
      "code":2E2,
   }
]

I have a field call errorData, when I use spath to access the json and do stats and mvzip(sym,code) function, it splits these events into two different events (but it is still not really what I want). How can I keep it into one event with the contents aggregated. Sometimes the array also only has 1 element, so it should be viable for that situation too

sym                     code                       count
ee,ie                 2E1,2E2                       1
ee                      2E2                         1

And I do not want the json with single element array to over-count, I mean mistakenly count matching in the multiple elements json.

0 Karma

somesoni2
Revered Legend

Try this

index=index | spath input=errorMsg path={}.sym output=sym | spath input=errorMsg path={}.code output=code | nomv sym | nomv code | stats count by sym code
0 Karma

exocore123
Path Finder

Wow... that was so much easier than I thought, is there a way I can introduce a comma within the space? Using rex or makedelim or join maybe?

0 Karma

somesoni2
Revered Legend

You can do like this (assuming the value of sym and code do not contain spaces on their own.

above search
| eval sym=replace(sym," ",", ") | eval code=replace(code," ",", ")
0 Karma

somesoni2
Revered Legend

Can you provide your current full search that you're using?

0 Karma

exocore123
Path Finder

index=index | spath input=errorMsg path={}.sym output=sym | spath input=errorMsg path={}.code output=code | stats count by sym, code

0 Karma

exocore123
Path Finder

Or eval msg=mvzip(sym, code) | stats count by msg would get me two events listed instead of 4 like above

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!