0

I want to count the number of occurrence of a specific JSON structure. For example in my event there is a field called data which its value is JSON . but this field can have a variety of structures. like:

data = {a: "b"}
data= {d: "x", h: "e"} 
...

now I want to know how many event has data with each JSON structure and I don't care about values only keys are matter.

Samira Arabgol
  • 359
  • 2
  • 5
  • 22

1 Answers1

0

Try one of these 2:

index=ndx sourcetype=srctp data=*
| stats dc(data) as unique_data

Or

index=ndx sourcetype=srctp data=*
| stats values(data) as data_vals
warren
  • 32,620
  • 21
  • 85
  • 124