Splunk Search

How do I count fields inside a JSON array

jwhughes58
Contributor

Hi,

I have this data

{"quarantineFolder": null, "spamScore": 100, "threatsInfoMap": [{"campaignID": null, "threat": "http://weg-aus-dem-hamsterrad.de/r5romlp/verif.myacc.resourses.biz/", "threatUrl": "https://threatinsight.proofpoint.com/cac61cbd-474f-77be-4915-2f27623219e4/threat/email/38e20c3d0a5c30dae9cc53f0fb77099a536a879530d4ded89209eb68db8be620", "classification": "malware", "threatType": "url", "threatID": "38e20c3d0a5c30dae9cc53f0fb77099a536a879530d4ded89209eb68db8be620", "threatTime": "2019-03-21T19:36:06.000Z", "threatStatus": "active"}], "replyToAddress": [], "phishScore": 0, "eventType": "messagesBlocked", "toAddresses": [“xyzzy@company.com”], "policyRoutes": ["default_inbound", "Inbound"], "messageParts": [{"md5": "4e12ab62f710e02270e02fdfad9a1817", "oContentType": "text/plain", "contentType": "text/plain", "disposition": "inline", "sha256": "d97d9261a6f0795bec34f055b997b01ec5f02b71f28d71aa88da47883c6df023", "sandboxStatus": null, "filename": "text.txt"}, {"md5": "fddffa81e7b4fe62073e0aab0336af76", "oContentType": "text/html", "contentType": "text/html", "disposition": "inline", "sha256": "43649abeaa49d66a1f4c36577251fd0578d6852c867d6fa4d3c26155eede56b0", "sandboxStatus": null, "filename": "text.html"}], "fromAddress": [], "QID": "2rbvw7q840-1", "xmailer": null, "senderIP": “1.1.1.1”, "sender": “plugh@company2.com”, "quarantineRule": null, "ccAddresses": [], "completelyRewritten": false, "messageTime": "2019-03-21T19:36:03.000Z", "recipient": [“xyzzy@company.com”], "messageSize": 3892, "headerReplyTo": null, "modulesRun": ["access", "smtpsrv", "av", "zerohour", "spf", "dkimv", "sandbox", "spam", "dmarc", "pdr", "urldefense"], "cluster": “prod_host”, "impostorScore": 0.0, "headerFrom": “Narf <narf@company.com> <plugh@company2.com>”, "GUID": "V-5swmMYZHoDpbgyPsQ9tN9LtKfCwHUK", "malwareScore": 100, "messageID": "<8TJjwegKPa6rThF30mDqDCkVzV36CA8OoaMbImztyGguX8SRF7d@kp.org>", "subject": “Narf Transaction for your invoice"}

I'm seeing an issue where the sender value isn't extracted if the number of items in the threatsInfoMap is large. Does someone have a suggestion for counting the items in the threatsInfoMap so I can see if this is what is happening?

TIA,
Joe

0 Karma
1 Solution

jwhughes58
Contributor

My co-worker finally got enough time to look at this for me. The solution is

| spath threatsInfoMap{} output=threatsElements
| stats count(threatsElements) AS threatsElementsCount by _time

View solution in original post

0 Karma

jwhughes58
Contributor

My co-worker finally got enough time to look at this for me. The solution is

| spath threatsInfoMap{} output=threatsElements
| stats count(threatsElements) AS threatsElementsCount by _time

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...