Splunk Search

tstat count over nested fields using spath and groupby doesnt return result

sidsinhad
Engager

I have a data set as follows, under index market-list

{ Resource: {
       Fruit: mango
       Type: sweet 
      } 
       Attribute: {
        color: yellow
         from: { 
           place: argentina
           continent: southamerica
         } 
      }
   actions: [{ export : yes }]
}

I want to use tstat as below to count all resources matching a given fruit, and also groupby multiple fields that are nested.

| tstats count | spath | rename "Resource.Fruit" as fruitname | search fruitname=mango where index=market-list groupby fruitname Attribute.from.place actions{}.export

But the above returns me no result. What could I be doing wrong?

0 Karma

woodcock
Esteemed Legend

When you do | tstats count you have thrown away all event data with the exception of count. You cannot use tstats anyway because this relies in index-time fields but you don't have those because spath creates search-time fields. Try something like this:

index="market-list" AND sourcetype=<And sourcetype too>
| spath
| rename "Resource.Fruit" AS fruitname
| stats count BY fruitname 'Attribute.from.place actions{}.export'
0 Karma

maciep
Champion

when in doubt, remove parts of your search until you can see where the problem lies. In this case, your very first command (tstats count) will literally create a number....that's it - at that point you don't have any data to use spath on and to filter farther with.

Splunk search works by getting a set of results and then passing that set of results to other commands that act on it. Each command changes the set of results before sending to them to the next command in the pipe list.

If your first set of results is one row with one count field, you're going to be able to do much with it.

Do you know what sourcetype your data is? That may tell us if we can use tstats at all, or whether we have to search the index for the raw data and the filter it.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...