https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-create-12-month-trend-line-from-data-getting-from-a-JSON/m-p/471896#M58003 <P>Something like this should work for you, but you might need to play around with it a little to get the exact form you want (I didn't know if you had an _time field from these logs and if it correlated with the date stamp you had).</P> <PRE><CODE>| baseSearch | eval zip=mvzip('graph_data.ratings{}.y', 'graph_data.ratings{}x') | mvexpand zip | eval zip=split(zip, ",") | eval ratings=mvindex(zip,0) | eval time=mvindex(zip,1) | eval _time=strptime(time, "%Y-%m-%d") | timechart values(ratings) span=w </CODE></PRE> <P>Essentially, zip each value pair together, expand them into their own rows, index out the values, create a _time field if it doesn't exist, then plug that into a timechart command. Hope this helps!</P> Mon, 23 Dec 2019 16:12:22 GMT aberkow 2019-12-23T16:12:22Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-create-12-month-trend-line-from-data-getting-from-a-JSON/m-p/471895#M58002 <P>Have to create 12- month trend line and data I am getting it in JSON. Please check the enclosed screenshot, I could able to create the <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8124iC3E5A1E0161C4938/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span>table.</P> Mon, 23 Dec 2019 08:19:09 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-create-12-month-trend-line-from-data-getting-from-a-JSON/m-p/471895#M58002 chiraggl 2019-12-23T08:19:09Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-create-12-month-trend-line-from-data-getting-from-a-JSON/m-p/471896#M58003 <P>Something like this should work for you, but you might need to play around with it a little to get the exact form you want (I didn't know if you had an _time field from these logs and if it correlated with the date stamp you had).</P> <PRE><CODE>| baseSearch | eval zip=mvzip('graph_data.ratings{}.y', 'graph_data.ratings{}x') | mvexpand zip | eval zip=split(zip, ",") | eval ratings=mvindex(zip,0) | eval time=mvindex(zip,1) | eval _time=strptime(time, "%Y-%m-%d") | timechart values(ratings) span=w </CODE></PRE> <P>Essentially, zip each value pair together, expand them into their own rows, index out the values, create a _time field if it doesn't exist, then plug that into a timechart command. Hope this helps!</P> Mon, 23 Dec 2019 16:12:22 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-create-12-month-trend-line-from-data-getting-from-a-JSON/m-p/471896#M58003 aberkow 2019-12-23T16:12:22Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-create-12-month-trend-line-from-data-getting-from-a-JSON/m-p/471897#M58004 <PRE><CODE>| makeresults count=2 | eval time=split("2018-12-02#2019-03-24","#") | mvexpand time | eval _time=strptime(time,"%F") | makecontinuous span=7d _time | eval temp="480.0,480.0,480.0,470.0,470.0,470.0,460.0,460.0,460.0,460.0,470.0,510.0,510.0,510.0,520.0,530.0,530.0" | streamstats current=f count | eval y=mvindex(split(temp,","),count) | eval x=strftime(_time,"%F") | table y x | eval count = 1 | stats list(*) as * by count | rename x as "graph_data.ratings{}.x" | rename y as "graph_data.ratings{}.y" | fields - count | rename COMMENT as "this is sample you provide" | rename COMMENT as "from here, the logic" | eval _time=strptime('graph_data.ratings{}.x',"%F") | stats list(*) as * by _time | streamstats current=f count | eval rating=mvindex('graph_data.ratings{}.y',count) | table _time rating | rename COMMENT as "viz &gt; Line Chart" </CODE></PRE> <P>Hi, @chiraggl<BR /> I chose not to use <CODE>mvexpand</CODE>.</P> Tue, 24 Dec 2019 07:42:36 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-create-12-month-trend-line-from-data-getting-from-a-JSON/m-p/471897#M58004 to4kawa 2019-12-24T07:42:36Z