Splunk Search
Highlighted

mvzip json array of values in one event

Path Finder
[  
   {  
      "sym":"ee",
      "code":2E1,
   },
   {  
      "sym":"ie",
      "code":2E2,
   }
]

I have a field call errorData, when I use spath to access the json and do stats and mvzip(sym,code) function, it splits these events into two different events (but it is still not really what I want). How can I keep it into one event with the contents aggregated. Sometimes the array also only has 1 element, so it should be viable for that situation too

sym                     code                       count
ee,ie                 2E1,2E2                       1
ee                      2E2                         1

And I do not want the json with single element array to over-count, I mean mistakenly count matching in the multiple elements json.

0 Karma
Highlighted

Re: mvzip json array of values in one event

SplunkTrust
SplunkTrust

Can you provide your current full search that you're using?

0 Karma
Highlighted

Re: mvzip json array of values in one event

Path Finder

index=index | spath input=errorMsg path={}.sym output=sym | spath input=errorMsg path={}.code output=code | stats count by sym, code

0 Karma
Highlighted

Re: mvzip json array of values in one event

Path Finder

Or eval msg=mvzip(sym, code) | stats count by msg would get me two events listed instead of 4 like above

0 Karma
Highlighted

Re: mvzip json array of values in one event

SplunkTrust
SplunkTrust

Try this

index=index | spath input=errorMsg path={}.sym output=sym | spath input=errorMsg path={}.code output=code | nomv sym | nomv code | stats count by sym code
0 Karma
Highlighted

Re: mvzip json array of values in one event

Path Finder

Wow... that was so much easier than I thought, is there a way I can introduce a comma within the space? Using rex or makedelim or join maybe?

0 Karma
Highlighted

Re: mvzip json array of values in one event

SplunkTrust
SplunkTrust

You can do like this (assuming the value of sym and code do not contain spaces on their own.

above search
| eval sym=replace(sym," ",", ") | eval code=replace(code," ",", ")
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.