topic Re: spath for the JSON in Getting Data In

spath for the JSON

sanjax90 — Tue, 12 May 2020 14:11:27 GMT

How can we use spath for below JSON to evaluate if for ConcurrentAsyncGetReportInstances , Remaining/Max*100 is >= 70%? Coul any one please help?

{
"AnalyticsExternalDataSizeMB":{
"Max":478600,
"Remaining":40960
},
"ConcurrentAsyncGetReportInstances":{
"Max":400,
"Remaining":200
},
"ConcurrentEinsteinDataInsightsStoryCreation":{
"Max":5,
"Remaining":5
},
"ConcurrentEinsteinDiscoveryStoryCreation":{
"Max":2,
"Remaining":2
},
"ConcurrentSyncReportRuns":{
"Max":20,
"Remaining":20
},
"DailyAnalyticsDataflowJobExecutions":{
"Max":60,
"Remaining":60
},
"DailyAnalyticsUploadedFilesSizeMB":{
"Max":51200,
"Remaining":51200
},

Re: spath for the JSON

to4kawa — Tue, 12 May 2020 21:49:42 GMT

your search
| spath
| eval perc = ('ConcurrentAsyncGetReportInstances{}.Max' / 'ConcurrentAsyncGetReportInstances{}.Remaining' * 100)
| where perc >= 70

Re: spath for the JSON

sanjax90 — Wed, 13 May 2020 07:09:29 GMT

This search query is running but there are no results. upon removing: | where perc >= 70 , i see the normal search result that i was getting earlier in the form of JSON and nothing new in the left panel(Selected Fields or Interesting Fields)

Re: spath for the JSON

to4kawa — Wed, 13 May 2020 08:51:49 GMT

nothing new
your sample is wrong. These are multivalues, aren't you?

Re: spath for the JSON

sanjax90 — Wed, 13 May 2020 09:50:39 GMT

the sample is correct and I achieved it via regular expressions : ConcurrentSyncReportRuns\':\s{\'Max':\s(?\d+)\,\s'Remaining':\s(?\d+),

Re: spath for the JSON

to4kawa — Wed, 13 May 2020 10:17:24 GMT

If you use rex, what's problem?
use eval to calculate.