topic Json parsing in Dashboards & Visualizations

Json parsing

incoghnito_1 — Tue, 07 Dec 2021 13:27:58 GMT

Hello ,
I realy hope you can help me !! 🙂
I have a json from API request (dynatrace).

I would like to have the value agent version for each host

How can i do this ?

My command :

***index="dynatrace_hp" "agentVersion.major"="*" "agentVersion.major"="*" "agentVersion.minor"="*" esxiHostName="*" | stats values(esxiHostName, ) values(agentVersion.minor)***

Thx for you Help !!!

Re: Json parsing

gcusello — Tue, 07 Dec 2021 13:29:31 GMT

Hi @incoghnito_1,

let me understand: have you problems in field extractions or in the stats command?

in other words, if you run the main search (without the stats command), have you the fields to use in the stats command or not?

if not you could use the "spath" command or a regex to exctract the needed fields fields.

Ciao.

Giuseppe

Re: Json parsing

Vardhan — Tue, 07 Dec 2021 13:37:18 GMT

Hi @incoghnito_1

Try the below SPL command

index="dynatrace_hp" "agentVersion.major"="*" "agentVersion.major"="*" "agentVersion.minor"="*" esxiHostName="*" | stats values(agentVersion.minor) by esxiHostName

Re: Json parsing

incoghnito_1 — Tue, 07 Dec 2021 13:43:05 GMT

thx for your help !
I have difficulty having the agents version for each hosts I am looking for the command to do this

Re: Json parsing

incoghnito_1 — Tue, 07 Dec 2021 15:14:07 GMT

works thx you very much have a good day !

Re: Json parsing

gcusello — Tue, 07 Dec 2021 15:15:26 GMT

Hi @incoghnito_1,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉