Search code examples
splunksplunk-query

How to evaluate a Splunk field which represents the length of another field?

I've loaded the following example file containing lines of JSON into Splunk:

{"duration":2134,"input":["foo","bar"],"level":"info","msg":"Processed input","time":"2022-04-07T08:10:23.14427-07:00"}
{"duration":997,"input":["baz"],"level":"info","msg":"Processed input","time":"2022-04-07T08:10:23.144526-07:00"}

Splunk has parsed these fields such that the input field is a list: enter image description here I would like to generate a table of the length of (number of elements in) the input and the duration field. Following https://docs.splunk.com/Documentation/StreamProcessor/standard/FunctionReference/List#length.28input.29, I've tried

msg="Processed input" 
| eval N=length(input) 
| table N, duration

but this yields no values for N:

enter image description here

What would be the correct way to determine N?

Solution

  • Use mvcount('input{}') in replace of length(input)

    Edit: Put Single quotes around input{} as {,} are special characters.