Splunk Search

Creating dashboard with 4 columns

shenoyveer
Path Finder

Hi Team,

I am sending json data to Splunk server and I want to create a dashboard out of it.

My data is in the below format and I need help in creating the dashboard out of it.

 

example:

{"value": ["new-repo-1: 2: yes: 17", "new-repo-2: 30:no:10", "new-one-3:15:yes:0", "old-repo: 10:yes:23", "my-repo: 10:no:15"]} and many more similar entries.

 

my dashboard should look like,

reposcountactivecount
new-repo2yes17
new-repo-230no10
new-one-315yes0
old-repo10yes23
my-repo10no15

 

I am able to write the rex for single field using extract pairdelim="\"{,}" kvdelim=":" but not able to do it for complete dashboard.

can someone help?

 

Thanks,

Veeresh Shenoy

Labels (2)
0 Karma
1 Solution

shenoyveer
Path Finder

I got the query that we need to use dedup 

thanks anyway.

View solution in original post

0 Karma

shenoyveer
Path Finder

Thank you soo much @ITWhisperer 

this worked for me 🙂

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your data looks like JSON so perhaps you should start by extracting the value collection into a multivalue field. You can then use mvexpand to split it into separate events, and use rex to extract the fields. Note that you can't have two columns / fields with the same name as you have shown

| spath value{} output=value
| mvexpand value
| rex field=value "(?<repos>[^:]+):\s*(?<count>\d+):\s*(?<active>\w+):\s*(?<othercount>\d+)"
| table repos count active othercount

shenoyveer
Path Finder

This query worked but I have found one issue that its taking duplicate values in dashboard if we run it again

is there any way that we can avoid old value if we run multiple times in lesser time?

 

0 Karma

shenoyveer
Path Finder

I got the query that we need to use dedup 

thanks anyway.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...