Splunk Search

How I can use the rename command in my search on JSON data?

rupesh_patil20
Path Finder

Hi.. I have json data such as

{"result": 
   [
    {"EventData.mlsnumber": "1039455", "result": 1}, 
    {"EventData.mlsnumber": "1189814", "result": 1}, 
    {"EventData.mlsnumber": "1218148", "result": 1}, 
    {"EventData.mlsnumber": "1247031", "result": 4}, 
    {"EventData.mlsnumber": "1290591", "result": 1}, 
    {"EventData.mlsnumber": "4629170", "result": 1}, 
    {"EventData.mlsnumber": "4629729", "result": 1}, 

   ]
}

I want to display EventData.mlsnumber in an MLS_Number column and result in a Count column. I have gone through this website http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/spath but did not get any single output.
For your information, I am getting the result from the REST API into the Splunk search. Can you please help me with the search?
The search started as: source="rest://mls_number" which gives results when I perform search, so what should I add after that?

Thanks!!

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

So a simple rename will work.

source="rest://mls_number" | rename result{}.EventData.mlsnumber AS MLS_Number result{}.result AS Count

But, a caveat here is that the fields are multivalue and won't expand correctly. when you try to do stats on the mls numbers.
So after the search above, do this:

eval atmp = mvzip(MLS_Number,Count) | mvexpand atmp | eval a=split(atmp,",")|eval Count = mvindex(a,1)|eval MLS_Number=mvindex(a,0) | <other stats>

The other stats will allow you to do time based calculations by MLS_Number.

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

So a simple rename will work.

source="rest://mls_number" | rename result{}.EventData.mlsnumber AS MLS_Number result{}.result AS Count

But, a caveat here is that the fields are multivalue and won't expand correctly. when you try to do stats on the mls numbers.
So after the search above, do this:

eval atmp = mvzip(MLS_Number,Count) | mvexpand atmp | eval a=split(atmp,",")|eval Count = mvindex(a,1)|eval MLS_Number=mvindex(a,0) | <other stats>

The other stats will allow you to do time based calculations by MLS_Number.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...