Splunk Search

Help extracting totalCount out of nested JSON

bhavya49
New Member
{ [-]
   detailMap: { [-]
     critical: false
     result: 0
     totalCnt: 5
     txnCountWithIgnoredIRC: 0
     warning: false
   }
   id: 60300000000
   name: EBALL
}

I'm trying to extract totalCount out of the nested Json. I'm trying the below search to extract it:

index="pas" source="agent.log" | spath output=myCount path=detailMap{}.totalCnt | table myCount

When I'm running this search, myCount column is blank.
Please let me know how to improvise this search.

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval _raw = "{ 
    \"detailMap\": { 
      \"critical\": \"false\",
      \"result\": \"0\",
      \"totalCnt\": \"5\",
      \"txnCountWithIgnoredIRC\": \"0\",
      \"warning\": \"false\"
    },
    \"id\": \"60300000000\",
    \"name\": \"EBALL\"
 }"
| spath

From this results,

index="pas" source="agent.log" 
| spath output=myCount path=detailMap.totalCnt 
| table myCount

It looks like the field name is different.

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval temp="{
  \"detailMap\": {
    \"critical\": false,
    \"result\": 0,
    \"totalCnt\": 5,
    \"txnCountWithIgnoredIRC\": 0,
    \"warning\": false
  },
  \"id\": 60300000000,
  \"name\": \"EBALL\"
        }" 
| spath input=temp output=totalCnt path=detailMap{}.totalCnt | table totalCnt
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...