topic Re: How to draw a table that digests a field which varies differently in Getting Data In

How to draw a table that digests a field which varies differently

Saer000 — Mon, 27 Jun 2022 14:27:28 GMT

Hi, I wanna plot a table to indicate the scanner status of Gitlab repos in the dashboard, like below: (1 means enabled, 0 means no used).

fullPath	SAST	SAST_IAC	DAST	DEPENDENCY_SCANNING	CONTAINER_SCANNING	SECRET_DETECTION	COVERAGE_FUZZING	API_FUZZING	CLUSTER_IMAGE_SCANNING
repos1	1	0	0	1	0	1	0	0	0
repos2	1	1	1	1	1	1	0	0	0
repos3	1	0	0	1	1	1	1	1	0

And my raw data stream look like below:

{"fullPath": "repos1", "securityScanners": {"available": ["SAST", "SAST_IAC", "DAST", "DEPENDENCY_SCANNING", "CONTAINER_SCANNING", "SECRET_DETECTION", "COVERAGE_FUZZING", "API_FUZZING", "CLUSTER_IMAGE_SCANNING"], "enabled": ["SAST", "DEPENDENCY_SCANNING", "SECRET_DETECTION"], "pipelineRun": ["SAST", "DEPENDENCY_SCANNING", "SECRET_DETECTION"]}} {"fullPath": "repos2", "securityScanners": {"available": ["SAST", "SAST_IAC", "DAST", "DEPENDENCY_SCANNING", "CONTAINER_SCANNING", "SECRET_DETECTION", "COVERAGE_FUZZING", "API_FUZZING", "CLUSTER_IMAGE_SCANNING"], "enabled": ["SAST", "DEPENDENCY_SCANNING", "SECRET_DETECTION"], "pipelineRun": ["SAST", "DEPENDENCY_SCANNING", "SECRET_DETECTION", "DAST"]}}

Could anyone help me build a search language to achieve the above?

Re: How to draw a table that digests a field which varies differently

richgalloway — Mon, 27 Jun 2022 15:23:26 GMT

What have you tried so far? How have those efforts not met expectations?

Re: How to draw a table that digests a field which varies differently

bowesmana — Tue, 28 Jun 2022 01:34:32 GMT

Here is an example using your example data

| makeresults | eval x=split("{\"fullPath\": \"repos1\", \"securityScanners\": {\"available\": [\"SAST\", \"SAST_IAC\", \"DAST\", \"DEPENDENCY_SCANNING\", \"CONTAINER_SCANNING\", \"SECRET_DETECTION\", \"COVERAGE_FUZZING\", \"API_FUZZING\", \"CLUSTER_IMAGE_SCANNING\"], \"enabled\": [\"SAST\", \"DEPENDENCY_SCANNING\", \"SECRET_DETECTION\"], \"pipelineRun\": [\"SAST\", \"DEPENDENCY_SCANNING\", \"SECRET_DETECTION\"]}}X{\"fullPath\": \"repos2\", \"securityScanners\": {\"available\": [\"SAST\", \"SAST_IAC\", \"DAST\", \"DEPENDENCY_SCANNING\", \"CONTAINER_SCANNING\", \"SECRET_DETECTION\", \"COVERAGE_FUZZING\", \"API_FUZZING\", \"CLUSTER_IMAGE_SCANNING\"], \"enabled\": [\"SAST\", \"DEPENDENCY_SCANNING\", \"SECRET_DETECTION\"], \"pipelineRun\": [\"SAST\", \"DEPENDENCY_SCANNING\", \"SECRET_DETECTION\", \"DAST\"]}}","X") | mvexpand x | rename x as _raw | spath | fields - _raw | rename securityScanners.* as * | chart values(enabled{}) by fullPath available{} | foreach * [ eval <<FIELD>>=if("<<MATCHSTR>>"="fullPath", <<FIELD>>, if(isnull(mvfind(<<FIELD>>, "<<MATCHSTR>>")), 0, 1)) ]

The search fragment you need will be the last 3 lines and it assumes that your JSON fields have been extracted based on their JSON names.

Re: How to draw a table that digests a field which varies differently

Saer000 — Tue, 28 Jun 2022 10:39:35 GMT

Thanks a lot, it really works on my side.