tstat count over nested fields using spath and groupby doesnt return result

[sidsinhad]

I have a data set as follows, under index market-list

{ Resource: {
       Fruit: mango
       Type: sweet 
      } 
       Attribute: {
        color: yellow
         from: { 
           place: argentina
           continent: southamerica
         } 
      }
   actions: [{ export : yes }]
}

I want to use tstat as below to count all resources matching a given fruit, and also groupby multiple fields that are nested.

| tstats count | spath | rename "Resource.Fruit" as fruitname | search fruitname=mango where index=market-list groupby fruitname Attribute.from.place actions{}.export

But the above returns me no result. What could I be doing wrong?

[woodcock]

When you do | tstats count you have thrown away all event data with the exception of count. You cannot use tstats anyway because this relies in index-time fields but you don't have those because spath creates search-time fields. Try something like this:

index="market-list" AND sourcetype=<And sourcetype too>
| spath
| rename "Resource.Fruit" AS fruitname
| stats count BY fruitname 'Attribute.from.place actions{}.export'

[maciep]

when in doubt, remove parts of your search until you can see where the problem lies. In this case, your very first command (tstats count) will literally create a number....that's it - at that point you don't have any data to use spath on and to filter farther with.

Splunk search works by getting a set of results and then passing that set of results to other commands that act on it. Each command changes the set of results before sending to them to the next command in the pipe list.

If your first set of results is one row with one count field, you're going to be able to do much with it.

Do you know what sourcetype your data is? That may tell us if we can use tstats at all, or whether we have to search the index for the raw data and the filter it.