https://community.splunk.com/t5/Dashboards-Visualizations/How-to-parse-JSON-with-multiple-array-to-barchart/m-p/462125#M45508 <P>@cuongnguyen112 </P> <P>Can you please try this?</P> <PRE><CODE>YOUR_SEARCH | rename sysinfo.ram{}.* as * | eval tmp =mvzip(name,usage) | mvexpand tmp | eval name=mvindex(split(tmp,","),0),usage=mvindex(split(tmp,","),1) | table name usage </CODE></PRE> <P>My Sample Search:</P> <PRE><CODE>| makeresults | eval _raw="{\"source\": \"sadmin\",\"sysinfo\": {\"ram\": [{\"name\": \"ram\",\"usage\": 1243},{\"name\": \"ram0\",\"usage\": 1215},{\"name\": \"ram1\",\"usage\": 2151}],}}" | extract | rename sysinfo.ram{}.* as * | eval tmp =mvzip(name,usage) | mvexpand tmp | eval name=mvindex(split(tmp,","),0),usage=mvindex(split(tmp,","),1) | table name usage </CODE></PRE> <P>Thanks</P> Thu, 17 Oct 2019 06:47:45 GMT kamlesh_vaghela 2019-10-17T06:47:45Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-parse-JSON-with-multiple-array-to-barchart/m-p/462124#M45507 <P>hi, i got data like this <BR /> {<BR /> "source": "sadmin",<BR /> "sysinfo": {<BR /> "ram": [<BR /> {<BR /> "name": "ram",<BR /> "usage": 1243<BR /> },<BR /> {<BR /> "name": "ram0",<BR /> "usage": 1215<BR /> },<BR /> {<BR /> "name": "ram1",<BR /> "usage": 2151<BR /> }<BR /> ],<BR /> }<BR /> }</P> <P>i need to create a barchart from these data like img below: <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7833i0347AAD694B31AF7/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Can any one help me please !</P> Thu, 17 Oct 2019 04:34:26 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-parse-JSON-with-multiple-array-to-barchart/m-p/462124#M45507 cuongnguyen112 2019-10-17T04:34:26Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-parse-JSON-with-multiple-array-to-barchart/m-p/462125#M45508 <P>@cuongnguyen112 </P> <P>Can you please try this?</P> <PRE><CODE>YOUR_SEARCH | rename sysinfo.ram{}.* as * | eval tmp =mvzip(name,usage) | mvexpand tmp | eval name=mvindex(split(tmp,","),0),usage=mvindex(split(tmp,","),1) | table name usage </CODE></PRE> <P>My Sample Search:</P> <PRE><CODE>| makeresults | eval _raw="{\"source\": \"sadmin\",\"sysinfo\": {\"ram\": [{\"name\": \"ram\",\"usage\": 1243},{\"name\": \"ram0\",\"usage\": 1215},{\"name\": \"ram1\",\"usage\": 2151}],}}" | extract | rename sysinfo.ram{}.* as * | eval tmp =mvzip(name,usage) | mvexpand tmp | eval name=mvindex(split(tmp,","),0),usage=mvindex(split(tmp,","),1) | table name usage </CODE></PRE> <P>Thanks</P> Thu, 17 Oct 2019 06:47:45 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-parse-JSON-with-multiple-array-to-barchart/m-p/462125#M45508 kamlesh_vaghela 2019-10-17T06:47:45Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-parse-JSON-with-multiple-array-to-barchart/m-p/462126#M45509 <P>Thank you, that's totally what is need</P> Thu, 17 Oct 2019 07:30:51 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-parse-JSON-with-multiple-array-to-barchart/m-p/462126#M45509 cuongnguyen112 2019-10-17T07:30:51Z