topic Re: How to select just JSON properties and display it on a chart? in Splunk Search

How to select just JSON properties and display it on a chart?

gcescatto — Tue, 29 Sep 2020 15:22:19 GMT

How can I select the JSON properties and display them on a bar chart? Not their value, but their name. I need to build a bar chart similar to this one above, where the X axis is the different NAMES of JSON properties, the Y axis is the COUNT of each JSON propertie's values (there are three options: true, false and missing) and the colors must be the JSON properties values.

The json I have is:
JsonData="{
"Uniformance_Oracle_Access":"True"
"FACTS_Access":"True"
"Oracle_GG":"False"}"

So far I was just able to display the values in the colors and do a Y-axis correctly, but the X-axis has been a real problem.

Re: How to select just JSON properties and display it on a chart?

niketn — Thu, 17 Aug 2017 04:23:22 GMT

Where do you get the value for each of the columns? It is not present in your sample JSON

Re: How to select just JSON properties and display it on a chart?

gcescatto — Fri, 18 Aug 2017 23:20:06 GMT

The values are "True" and "False". It comes from PowerShell scripts that store data in the database. So, my application is a dbconnect application.

Re: How to select just JSON properties and display it on a chart?

niketn — Tue, 29 Sep 2020 15:24:25 GMT

What is missing criteria? What would corresponding event look like?

Sorry I could not find a neat way to do this. Hopefully other would be able to assist however, you can count True and False per series and then append the results for each series i.e. Uniformance_Oracle_Access, FACTS_Access, Oracle_GG

<YourBaseSearch>
| table Uniformance_Oracle_Access
| chart count(eval(Uniformance_Oracle_Access=="True")) as True count(eval(Uniformance_Oracle_Access=="False")) as False
| eval Field="Uniformance_Oracle_Access"
| append [ <YourBaseSearch>
                    | table FACTS_Access
                    | chart count(eval(FACTS_Access=="True")) as True count(eval(FACTS_Access=="False")) as False
                    | eval Field="FACTS_Access"]
| append [ <YourBaseSearch>
                    | table Oracle_GG
                    | chart count(eval(Oracle_GG=="True")) as True count(eval(Oracle_GG=="False")) as False
                    | eval Field="Oracle_GG"]

Then you need to create Stacked Column Chart for these. There should be a better way to do this as I am running the same search three times for append and if the data being correlation is more append might silently drop data giving skewed results. Please see if this still works for you until someone provides a better solution.

Re: How to select just JSON properties and display it on a chart?

gcescatto — Mon, 21 Aug 2017 11:48:26 GMT

The colors that should be only "True", "False" or "Missing" are displaying "True" and "Field". I'm trying to fix this. But the table displayed seems correct. Thank you (:

Re: How to select just JSON properties and display it on a chart?

niketn — Mon, 21 Aug 2017 12:00:46 GMT

@gcescatto, I have converted my comment to answer. Please accept to mark the question as Answered. Please let us know if further help is required!

Re: How to select just JSON properties and display it on a chart?

gcescatto — Mon, 21 Aug 2017 13:41:07 GMT

Could you please help me change places "Field" and "True"?
The table is correct, but the chart needs to be with "Field" at the X axis and "True" and "False" like colors. Sorry to bother, I'm new in Splunk.