topic Re: How to parse the result retrieved from influxDB in Getting Data In

How to parse the result retrieved from influxDB

u191477 — Fri, 25 Oct 2019 09:07:34 GMT

i try to retrieve data from influxDB. but I don't know how to parse the result that columns and values are separated.
| makeresults | eval results= {"series":[{"values":[["2019-10-25T06:02:18.369115741Z","A","1"],["2019-10-25T06:03:33.4004666Z","B","2"],["2019-10-25T06:04:01.104011287Z","C","3"],["2019-10-25T06:04:08.673023079Z","D","4"]],"columns":["time","field","tag"],"name":"test_measurement"}],"statement_id":0} | ???
can it be transformed into the table below?

|time|field|tag|

|2019-10-25T06:02:18.369115741Z|A|1|

|2019-10-25T06:03:33.4004666Z|B|2|

|2019-10-25T06:04:01.104011287Z|C|3|

|2019-10-25T06:04:08.673023079Z|D|4|

Re: How to parse the result retrieved from influxDB

to4kawa — Sat, 26 Oct 2019 00:22:51 GMT

| makeresults 
| eval _raw= "{\"series\":[{\"values\":[[\"2019-10-25T06:02:18.369115741Z\",\"A\",\"1\"],[\"2019-10-25T06:03:33.4004666Z\",\"B\",\"2\"],[\"2019-10-25T06:04:01.104011287Z\",\"C\",\"3\"],[\"2019-10-25T06:04:08.673023079Z\",\"D\",\"4\"]],\"columns\":[\"time\",\"field\",\"tag\"],\"name\":\"test_measurement\"}],\"statement_id\":0}"
`comment("this is sample data")`
| spath
| table series*
| foreach series{}.*{} 
    [rename <<FIELD>> as <<MATCHSTR>>]
| mvexpand values
| streamstats reset_after="match(values,\"\d+$\")" count
| eval field_name=mvindex(columns,count -1)
| streamstats count(eval(field_name=="time")) as tmp
| xyseries tmp field_name values
| table time field tag

Hi, how about this?

Re: How to parse the result retrieved from influxDB

u191477 — Mon, 28 Oct 2019 06:49:31 GMT

i really appreciate it!!

Re: How to parse the result retrieved from influxDB

to4kawa — Mon, 28 Oct 2019 10:49:05 GMT

your welcome, Happy Splunking.

Re: How to parse the result retrieved from influxDB

indeed_2000 — Mon, 18 Jul 2022 06:48:43 GMT

@u191477 @to4kawa

did you connect splunkdb with influxdb?

i try it but got error:

https://community.splunk.com/t5/Splunk-Search/driver-influxdb-to-splunk-db/m-p/605850#M210681

would please how do you do this?

Thanks