How can we write the Splunk Query to find subField2 is present or not and if present get the counts of all subFiled2

Question

{ index:"myIndex", field1: "myfield1", field2: {"subField1":"mySubField1","subField2":145,"subField3":500}, ... .. . }

SPL : index:"myIndex" eval result = if(field.subField2) ..... is the dot operator works in SPL ?

Answer 1

I am assuming your data is in JSON format. If so, you can use spath to extract fields from your structured data. Then just check if the field is present or not with isnotnull

index="myIndex" | spath | where isnotnull(field2.subField2)

Answer 2

Presuming your data is in JSON format, this should do it:

index=myIndex sourcetype=srctp field2{}.subField2=*

If those are multivalue fields, you'll need to do an mvexpand first