topic How to put data in table format in Splunk Search

How to put data in table format

chaitu1231 — Thu, 30 Apr 2020 22:17:16 GMT

Name :Test
"extensionData": {
"entries": [
{
"key": "machinesTotal",
"value": {
"type": "integer",
"value": 7
}
},
{
"key": "endpoint",
"value": {
"type": "string",
"value": "vcenter.local"
}
},
{
"key": "quotaAllocatedPercentage",
"value": {
"type": "string",
"value": "27% (6 of 22)"
}
},
{
"key": "storageUsed",
"value": {
"type": "integer",
"value": 1006
}
},
{
"key": "machinesAllocatedPercentage",
"value": {
"type": "string",
"value": "86% (6 of 7)"
}
},
{
"key": "memoryAllocatedPercentage",
"value": {
"type": "string",
"value": "20% (72 GB of 352 GB)"
}
},
{
"key": "computeResource",
"value": {
"type": "string",
"value": "Data-Cluster"
}
},
{
"key": "storageAllocatedPercentage",
"value": {
"type": "string",
"value": "23% (1006 GB of 4400 GB)"
}
},
{
"key": "storageUsedPercentage",
"value": {
"type": "string",
"value": "23% (1006 GB of 4400 GB)"
}
}
]
}
}

I need data in table format. Can you help me on this.

Re: How to put data in table format

tauliang — Thu, 30 Apr 2020 23:10:46 GMT

Something like this?

| makeresults  count =1
| eval _raw = "
{
  \"Name\": \"Test\",
  \"extensionData\": {
    \"entries\": [
      {
        \"key\": \"machinesTotal\",
        \"value\": {
          \"type\": \"integer\",
          \"value\": 7
        }
      },
      {
        \"key\": \"endpoint\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"vcenter.local\"
        }
      },
      {
        \"key\": \"quotaAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"27% (6 of 22)\"
        }
      },
      {
        \"key\": \"storageUsed\",
        \"value\": {
          \"type\": \"integer\",
          \"value\": 1006
        }
      },
      {
        \"key\": \"machinesAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"86% (6 of 7)\"
        }
      },
      {
        \"key\": \"memoryAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"20% (72 GB of 352 GB)\"
        }
      },
      {
        \"key\": \"computeResource\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"Data-Cluster\"
        }
      },
      {
        \"key\": \"storageAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"23% (1006 GB of 4400 GB)\"
        }
      },
      {
        \"key\": \"storageUsedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"23% (1006 GB of 4400 GB)\"
        }
      }
    ]
  }
}"

| spath
| rename extensionData.entries{}.key as key
| rename extensionData.entries{}.value.type as type
| rename extensionData.entries{}.value.value as value
| eval zipped=mvzip( key, mvzip( type, value ) )
| mvexpand zipped
| eval zipped=split( zipped, "," )
| eval key=mvindex( zipped, 0 )
| eval type=mvindex( zipped, 1 )
| eval value =mvindex( zipped, 2 )
| table key,value
| transpose

Re: How to put data in table format

vnravikumar — Fri, 01 May 2020 02:53:17 GMT

Try this

| makeresults count =1 
| eval _raw = "
 {
   \"Name\": \"Test\",
   \"extensionData\": {
     \"entries\": [
       {
         \"key\": \"machinesTotal\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 7
         }
       },
       {
         \"key\": \"endpoint\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"vcenter.local\"
                                                                                             }
       },
       {
         \"key\": \"quotaAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"27% (6 of 22)\"
                                                                                             }
       },
       {
         \"key\": \"storageUsed\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 1006
         }
       },
       {
         \"key\": \"machinesAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"86% (6 of 7)\"
                                                                                             }
       },
       {
         \"key\": \"memoryAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"20% (72 GB of 352 GB)\"
                                                                                             }
       },
       {
         \"key\": \"computeResource\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"Data-Cluster\"
                                                                                             }
       },
       {
         \"key\": \"storageAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                             }
       },
       {
         \"key\": \"storageUsedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                             }
       }
     ]
   }
 }" 
| spath path=extensionData.entries{}.key output=key 
| spath path=extensionData.entries{}.value.value output=value 
| spath path=Name output=Name 
| eval key_value_combined=mvzip(key,value) 
| stats values(Name) as Name by key_value_combined 
| eval key_value= split(key_value_combined,",") 
| eval key=mvindex(key_value,0),value=mvindex(key_value,1) 
| chart values(value) as value over Name by key

| makeresults count =1 
| eval _raw = "
 {
   \"Name\": \"Test\",
   \"extensionData\": {
     \"entries\": [
       {
         \"key\": \"machinesTotal\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 7
         }
       },
       {
         \"key\": \"endpoint\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"vcenter.local\"
                                                                                                         }
       },
       {
         \"key\": \"quotaAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"27% (6 of 22)\"
                                                                                                         }
       },
       {
         \"key\": \"storageUsed\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 1006
         }
       },
       {
         \"key\": \"machinesAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"86% (6 of 7)\"
                                                                                                         }
       },
       {
         \"key\": \"memoryAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"20% (72 GB of 352 GB)\"
                                                                                                         }
       },
       {
         \"key\": \"computeResource\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"Data-Cluster\"
                                                                                                         }
       },
       {
         \"key\": \"storageAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                                         }
       },
       {
         \"key\": \"storageUsedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                                         }
       }
     ]
   }
 }" 
| spath path=extensionData.entries{}.key output=key 
| spath path=extensionData.entries{}.value.value output=value 
| spath path=Name output=Name 
| eval key_value_combined=mvzip(key,value) 
| stats values(Name) as Name by key_value_combined 
| eval key_value= split(key_value_combined,",") 
| eval key=mvindex(key_value,0),value=mvindex(key_value,1) 
| eval {key}=value 
| stats values(*) as * 
| fields - key value key_value key_value_combined