topic Re: How to have my JSON output data in separate rows and not a single one? in Getting Data In

How to have my JSON output data in separate rows and not a single one?

Nadhiyaa — Wed, 29 Aug 2018 07:03:39 GMT

This is the output of my JSON data. I would want to see it in separate rows and not in a single row.
When I do mvexpand for each time it's taking all the count1 values.

My output should be separate rows with time and count1 value.

Re: How to have my JSON output data in separate rows and not a single one?

niketn — Wed, 29 Aug 2018 07:53:27 GMT

@Nadhiyaa as explained in my previous answer fields count1 and time need to be zipped together using mvzip() evaluation function. Try the following search based on your data:

  <yourCurrentSearch>
 | table count1 time
 | eval data=mvzip(count1, time) 
 | mvexpand data 
 | makemv data delim="," 
 | eval count1=mvindex(data,0),time=mvindex(data,1) 
 | fields - data

Re: How to have my JSON output data in separate rows and not a single one?

Nadhiyaa — Wed, 29 Aug 2018 08:01:42 GMT

Yes it worked .
Now i am trying add a trend in a single value format.

Re: How to have my JSON output data in separate rows and not a single one?

niketn — Wed, 29 Aug 2018 08:12:37 GMT

@Nadhiyaa you can call your time field as _time which should take care of showing data over time.

   <yourCurrentSearch>
  | table count1 time
  | eval data=mvzip(count1, time) 
  | mvexpand data 
  | makemv data delim="," 
  | eval count1=mvindex(data,0),_time=mvindex(data,1) 
  | table _time count1

If you want you can also add timechart command with required aggregating function like

 | timechart sum(count1) as Total

Re: How to have my JSON output data in separate rows and not a single one?

mstjohn_splunk — Wed, 29 Aug 2018 21:59:25 GMT

Hey @nadhiyaa,

Did @niketnilay help solve your problem? If so, would you approve his answer so that other users know it's legit. Also, could you toss him an upvote? MMM... upvotes.