Splunk Search

mvzip json array of values in one event

exocore123
Path Finder
[  
   {  
      "sym":"ee",
      "code":2E1,
   },
   {  
      "sym":"ie",
      "code":2E2,
   }
]

I have a field call errorData, when I use spath to access the json and do stats and mvzip(sym,code) function, it splits these events into two different events (but it is still not really what I want). How can I keep it into one event with the contents aggregated. Sometimes the array also only has 1 element, so it should be viable for that situation too

sym                     code                       count
ee,ie                 2E1,2E2                       1
ee                      2E2                         1

And I do not want the json with single element array to over-count, I mean mistakenly count matching in the multiple elements json.

0 Karma

somesoni2
Revered Legend

Try this

index=index | spath input=errorMsg path={}.sym output=sym | spath input=errorMsg path={}.code output=code | nomv sym | nomv code | stats count by sym code
0 Karma

exocore123
Path Finder

Wow... that was so much easier than I thought, is there a way I can introduce a comma within the space? Using rex or makedelim or join maybe?

0 Karma

somesoni2
Revered Legend

You can do like this (assuming the value of sym and code do not contain spaces on their own.

above search
| eval sym=replace(sym," ",", ") | eval code=replace(code," ",", ")
0 Karma

somesoni2
Revered Legend

Can you provide your current full search that you're using?

0 Karma

exocore123
Path Finder

index=index | spath input=errorMsg path={}.sym output=sym | spath input=errorMsg path={}.code output=code | stats count by sym, code

0 Karma

exocore123
Path Finder

Or eval msg=mvzip(sym, code) | stats count by msg would get me two events listed instead of 4 like above

0 Karma
Get Updates on the Splunk Community!

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...