https://community.splunk.com/t5/Dashboards-Visualizations/JSON-string-split-in-search/m-p/487278#M33162 <P>Thanks everyone, you have helped me a lot these last few days as I binge learn splunk... This question, im pretty sure, is an easy one, im just missing something obvious...... I grab JSON values that are a multivalue field so usage_info.voltage contains value1,valu2 Im trying to add value1 and value2 to a dashboard as two different single value displays. How can i modify my search to show one value or the other?</P> <P>RAW JSON DATA<BR />"voltage":[121.77615356445312,121.19967651367188]</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8797iBA90D1165B71D00C/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Sun, 07 Jun 2020 02:13:35 GMT pir8radio 2020-06-07T02:13:35Z https://community.splunk.com/t5/Dashboards-Visualizations/JSON-string-split-in-search/m-p/487278#M33162 <P>Thanks everyone, you have helped me a lot these last few days as I binge learn splunk... This question, im pretty sure, is an easy one, im just missing something obvious...... I grab JSON values that are a multivalue field so usage_info.voltage contains value1,valu2 Im trying to add value1 and value2 to a dashboard as two different single value displays. How can i modify my search to show one value or the other?</P> <P>RAW JSON DATA<BR />"voltage":[121.77615356445312,121.19967651367188]</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8797iBA90D1165B71D00C/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Sun, 07 Jun 2020 02:13:35 GMT https://community.splunk.com/t5/Dashboards-Visualizations/JSON-string-split-in-search/m-p/487278#M33162 pir8radio 2020-06-07T02:13:35Z https://community.splunk.com/t5/Dashboards-Visualizations/JSON-string-split-in-search/m-p/487279#M33163 <PRE><CODE>index="sense_power_monitor" | head 1| rename usage_info.voltage{} as voltage |mvexpand voltage | stats values(voltage) by voltage | streamstats count as voltage </CODE></PRE> <P>Viz &gt;&gt; single value with trellis <EM>voltage</EM></P> Sun, 26 Apr 2020 03:37:54 GMT https://community.splunk.com/t5/Dashboards-Visualizations/JSON-string-split-in-search/m-p/487279#M33163 to4kawa 2020-04-26T03:37:54Z https://community.splunk.com/t5/Dashboards-Visualizations/JSON-string-split-in-search/m-p/487280#M33164 <P>that just returns "1" and not "121.7713" like i would expect?<BR /> remember i'm using a single value display. </P> Sun, 26 Apr 2020 13:42:53 GMT https://community.splunk.com/t5/Dashboards-Visualizations/JSON-string-split-in-search/m-p/487280#M33164 pir8radio 2020-04-26T13:42:53Z https://community.splunk.com/t5/Dashboards-Visualizations/JSON-string-split-in-search/m-p/487281#M33165 <P><span class="lia-inline-image-display-wrapper" image-alt="single"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8796i052AA678E12D12EB/image-size/large?v=v2&amp;px=999" role="button" title="single" alt="single" /></span><BR /> I see.</P> Sun, 26 Apr 2020 19:22:07 GMT https://community.splunk.com/t5/Dashboards-Visualizations/JSON-string-split-in-search/m-p/487281#M33165 to4kawa 2020-04-26T19:22:07Z https://community.splunk.com/t5/Dashboards-Visualizations/JSON-string-split-in-search/m-p/487282#M33166 <P>I see, you are using Trellis. I can not use trellis, i need to use regular single value display. no matter what size i pick i can not fit my reading in a trellis view.</P> <P><IMG src="https://i.ibb.co/5YqvRBQ/Capture.png" alt="alt text" /></P> Sun, 26 Apr 2020 21:47:00 GMT https://community.splunk.com/t5/Dashboards-Visualizations/JSON-string-split-in-search/m-p/487282#M33166 pir8radio 2020-04-26T21:47:00Z https://community.splunk.com/t5/Dashboards-Visualizations/JSON-string-split-in-search/m-p/487283#M33167 <P>you use <EM>single</EM> value chart.<BR /> If you want to display multivalues , use trellis.<BR /> <CODE>i can not fit</CODE> <BR /> why do you append extra unit?</P> Sun, 26 Apr 2020 22:00:12 GMT https://community.splunk.com/t5/Dashboards-Visualizations/JSON-string-split-in-search/m-p/487283#M33167 to4kawa 2020-04-26T22:00:12Z https://community.splunk.com/t5/Dashboards-Visualizations/JSON-string-split-in-search/m-p/487284#M33168 <P>I need high resolution plus unit name. Looks fine in a single value display... Is there no way to filter out one of the two values, so i can display only one value? </P> Sun, 26 Apr 2020 22:23:10 GMT https://community.splunk.com/t5/Dashboards-Visualizations/JSON-string-split-in-search/m-p/487284#M33168 pir8radio 2020-04-26T22:23:10Z https://community.splunk.com/t5/Dashboards-Visualizations/JSON-string-split-in-search/m-p/487285#M33169 <P><A href="https://answers.splunk.com/answers/819450/how-to-display-2-numbers-on-in-the-same-single-val.html">https://answers.splunk.com/answers/819450/how-to-display-2-numbers-on-in-the-same-single-val.html</A></P> <P>this is single , too.</P> Mon, 27 Apr 2020 09:02:18 GMT https://community.splunk.com/t5/Dashboards-Visualizations/JSON-string-split-in-search/m-p/487285#M33169 to4kawa 2020-04-27T09:02:18Z