Hi,
I've got an event that looks like this:
rangeofproducts:{[-]
products:[[-]
{[-]
count:20
productID: A
}
{[-]
count:40
productID: B
So the fieldnames are:
rangeofproducts.products{}.count
rangeofproducts.products{}.productID
I would like to create a search thats results in the total count by productID for the event.
At the moment I think it won't work, but I hope I'm wrong...
| stats sum(rangeofproducts.products{}.count) by rangeofproducts.products{}.productID
This results in a total count of 60 for every productID. But a split 20/40 would be correct.
Best
Heinz
Hi,
Example 3 of the spath documentation seems to be the apporach for my problem.
{"widget": {
"text": {
"data": "Click here",
"size": 36,
"data": "Learn more",
"size": 37,
"data": "Help",
"size": 38,
I've tried it out and adjusted this search:
sourcetype=json | spath | rename widget.text.size AS size, widget.text.data AS
data | eval x=mvzip(data,size)| mvexpand x | eval x = split(x,",") | eval
data=mvindex(x,0) | eval size=mvindex(x,1) | table _time,data, size
In the end the search created individual events, but there are always duplicates. When I use the same search without | spath | it seems to be correct, but I've no idea why.
Is there an important difference in the structure of my event?
Thanks in advance
Heinz
Hi HeinzWaescher,
looks like JSON data, have you tried the spath command on your event and do your stats after that?
hope this helps ...
cheers, MuS
Hi MuS,
haven't heard about that command before, but it looks usefull for my problem. Thanks!