topic Re: How to extract JSON into a chart? in Getting Data In

How to extract JSON into a chart?

goe — Tue, 17 Apr 2018 08:34:38 GMT

Hello,

I have JSON string in the following format,

{"status":"503"}

and I would like to create a pie chart with the values of status, the number of occurrences for a time period.

So far I create this and I think I am close,

ERROR | spath output=status path=status | timechart count as "Error" by status

Re: How to extract JSON into a chart?

p_gurav — Tue, 17 Apr 2018 14:26:31 GMT

Can you try:

| makeresults | eval abc="{\"status\":\"503\"}"  | spath input=abc output=status path=status | timechart count by status

Re: How to extract JSON into a chart?

goe — Tue, 17 Apr 2018 15:03:52 GMT

Hey thanks! I managed to solve it using rex because it's JSON within regular text.

My solution is similiar to this.

But instead of displaying in table I did,

| rex field=_raw "status\":\"(?P<msg>.[^\"\"]*)" | chart count msg

Re: How to extract JSON into a chart?

somesoni2 — Tue, 17 Apr 2018 17:50:25 GMT

@goe, glad you were able to work out your issue. Please accept this answer to close the question. If possible, if you can add the solution (by editing this Answer), that'll help other Splunkers with similar issues.