topic Re: Extracting simple array of strings in Dashboards & Visualizations

Extracting simple array of strings

sankarms — Wed, 30 Mar 2016 22:18:35 GMT

I have a simple entry in my logs like so:

types=["A","B","C"]

There are several entries like that throughout the logs. Another one could look like this:

types=["B","C"]

Is there a way to extract the values from this array of strings and create a bar chart out of the occurrences of each type? So if splunk only saw the above 2 long entries it would make a bar chart with

"# of occurrences" on the y-axis
"Types" on the x-axis

And it would show 1 for type A, 2 for type B and C.

What would be the search criterion?

Re: Extracting simple array of strings

martin_mueller — Wed, 30 Mar 2016 22:31:58 GMT

You could cheat by going through spath parsing JSON:

... | eval types = "{\"types\": " + types + "}" | spath input=types | rename types{} as types | stats count by types

Alternatively, a bit of regexing around:

... | eval types = replace(types, "(^\[\")|(\"\]$)", "")| makemv types delim="\",\"" | stats count by types

Re: Extracting simple array of strings

sankarms — Wed, 30 Mar 2016 22:53:41 GMT

this doesn't extract the individual types separately. This gives back the whole list like so

["A","B","C"]

and counts it as 1 object.

Re: Extracting simple array of strings

martin_mueller — Wed, 30 Mar 2016 22:58:21 GMT

Odd - what happens when you run this in an empty search bar?

| stats count | eval foo = "types=[\"A\",\"B\",\"C\"] types=[\"B\",\"C\"]" | makemv foo | mvexpand foo | rename foo as _raw | extract | eval types = replace(types, "(^\[\")|(\"\]$)", "")| makemv types delim="\",\"" | stats count by types

Re: Extracting simple array of strings

sankarms — Wed, 30 Mar 2016 23:02:18 GMT

Sorry I'm an absolute idiot. I messed up something from your original command. It works perfectly fine now. Thank you.

Re: Extracting simple array of strings

martin_mueller — Wed, 30 Mar 2016 23:24:27 GMT

What does the statistics table look like, and what visualization are you using?