https://community.splunk.com/t5/Getting-Data-In/How-to-populate-Meaningful-form-of-data/m-p/417818#M73734 <P>Hi Guys,</P> <P>Can you please help me, in framing a query. </P> <P>Like i have this kind of data structure:<BR /> clk_ctrl: { [-] <BR /> GCC: { [-] <BR /> clock_name: [ [+] <BR /> ]<BR /><BR /> lowsvs: fail<BR /><BR /> minsvs: fail<BR /><BR /> nom: 0<BR /><BR /> nom_l1: n/a<BR /><BR /> svs: fail<BR /><BR /> svs_l1: fail<BR /><BR /> turbo: 0<BR /><BR /> turbo_l1: 0<BR /><BR /> type: GCC<BR /><BR /> }<BR /><BR /> MCCC: { [-] <BR /> lowsvs: fail<BR /><BR /> minsvs: fail<BR /><BR /> nom: fail<BR /><BR /> nom_l1: n/a<BR /><BR /> svs: fail<BR /><BR /> svs_l1: fail<BR /><BR /> turbo: fail<BR /><BR /> turbo_l1: n/a<BR /><BR /> type: MCCC<BR /><BR /> }<BR /><BR /> dpcc: { [-] <BR /> lowsvs: fail<BR /><BR /> minsvs: fail<BR /><BR /> nom: fail<BR /><BR /> nom_l1: n/a<BR /><BR /> svs: fail<BR /><BR /> svs_l1: fail<BR /><BR /> turbo: fail<BR /><BR /> turbo_l1: fail<BR /><BR /> type: DPCC<BR /><BR /> }<BR /><BR /> }<BR /><BR /> func_area: source <BR /> groupID: project<BR /><BR /> site: sandiego<BR /><BR /> submit_timestamp: Tue Jul 30 09:35:11 2019<BR /><BR /> tool: qvmrs<BR /><BR /> unique_tag: vl-vpulipak-ice_17044<BR /><BR /> }</P> <P>I want to print high level data like for GCC lowsvs, minsvs and this goes same for MCCC as well. </P> <P>But if i do rename on the field names, it is taking the last renamed one. So i couldn't populate the rest. </P> <P>Can you please help me in framing a query for this. </P> <P>Thanks,<BR /> Maniteja</P> Wed, 30 Sep 2020 01:32:15 GMT Maniteja81 2020-09-30T01:32:15Z https://community.splunk.com/t5/Getting-Data-In/How-to-populate-Meaningful-form-of-data/m-p/417818#M73734 <P>Hi Guys,</P> <P>Can you please help me, in framing a query. </P> <P>Like i have this kind of data structure:<BR /> clk_ctrl: { [-] <BR /> GCC: { [-] <BR /> clock_name: [ [+] <BR /> ]<BR /><BR /> lowsvs: fail<BR /><BR /> minsvs: fail<BR /><BR /> nom: 0<BR /><BR /> nom_l1: n/a<BR /><BR /> svs: fail<BR /><BR /> svs_l1: fail<BR /><BR /> turbo: 0<BR /><BR /> turbo_l1: 0<BR /><BR /> type: GCC<BR /><BR /> }<BR /><BR /> MCCC: { [-] <BR /> lowsvs: fail<BR /><BR /> minsvs: fail<BR /><BR /> nom: fail<BR /><BR /> nom_l1: n/a<BR /><BR /> svs: fail<BR /><BR /> svs_l1: fail<BR /><BR /> turbo: fail<BR /><BR /> turbo_l1: n/a<BR /><BR /> type: MCCC<BR /><BR /> }<BR /><BR /> dpcc: { [-] <BR /> lowsvs: fail<BR /><BR /> minsvs: fail<BR /><BR /> nom: fail<BR /><BR /> nom_l1: n/a<BR /><BR /> svs: fail<BR /><BR /> svs_l1: fail<BR /><BR /> turbo: fail<BR /><BR /> turbo_l1: fail<BR /><BR /> type: DPCC<BR /><BR /> }<BR /><BR /> }<BR /><BR /> func_area: source <BR /> groupID: project<BR /><BR /> site: sandiego<BR /><BR /> submit_timestamp: Tue Jul 30 09:35:11 2019<BR /><BR /> tool: qvmrs<BR /><BR /> unique_tag: vl-vpulipak-ice_17044<BR /><BR /> }</P> <P>I want to print high level data like for GCC lowsvs, minsvs and this goes same for MCCC as well. </P> <P>But if i do rename on the field names, it is taking the last renamed one. So i couldn't populate the rest. </P> <P>Can you please help me in framing a query for this. </P> <P>Thanks,<BR /> Maniteja</P> Wed, 30 Sep 2020 01:32:15 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-populate-Meaningful-form-of-data/m-p/417818#M73734 Maniteja81 2020-09-30T01:32:15Z https://community.splunk.com/t5/Getting-Data-In/How-to-populate-Meaningful-form-of-data/m-p/417819#M73735 <P>Hi. Is it in JSON format? If it is you could try with <STRONG>spath</STRONG> command.</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Spath">https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Spath</A><BR /> <A href="https://answers.splunk.com/answers/401942/how-to-parse-my-json-data-with-spath-and-table-the.html">https://answers.splunk.com/answers/401942/how-to-parse-my-json-data-with-spath-and-table-the.html</A></P> Tue, 30 Jul 2019 18:55:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-populate-Meaningful-form-of-data/m-p/417819#M73735 jaime_ramirez 2019-07-30T18:55:52Z