topic Re: Plotting bar chart X axis are JSON keys and Y axis are length of JSON values in Splunk Search

Plotting bar chart X axis are JSON keys and Y axis are length of JSON values

oKeNiDJE — Thu, 22 Jul 2021 11:40:38 GMT

I have the following JSON object.

I would like to be able to ultimately create a bar chart with the following:

X-Axis: Animal type ie dog, cat, chicken.....

Y-Axis: The length of animal's array, this example, dog=2 cat=3 chicken=1

{ "data": { "animals": { "dog": [{"name": "rex", "id": 1}, {"name": "tom", "id": 2}], "cat": [{"name": "rex", "id": 3}, {"name": "tom", "id": 4}, {"name": "sam", "id": 5}], "chicken": [{"name": "rex", "id": 6}] } } }

I'm new to Splunk so apologies but I'm not sure where to even begin

Thanks in advance for any help

Re: Plotting bar chart X axis are JSON keys and Y axis are length of JSON values

kamlesh_vaghela — Thu, 22 Jul 2021 16:06:00 GMT

@oKeNiDJE

Can you please try this?

My Sample Search :

| makeresults | eval _raw="{\"data\": {\"animals\": {\"dog\": [{\"name\": \"rex\", \"id\": 1}, {\"name\": \"tom\", \"id\": 2}],\"cat\": [{\"name\": \"rex\", \"id\": 3}, {\"name\": \"tom\", \"id\": 4}, {\"name\": \"sam\", \"id\": 5}],\"chicken\": [{\"name\": \"rex\", \"id\": 6}]}}}" | rex field=_raw "\"(?<animal>\w+)\":\s\[(?<arr>[^\]]*])" max_match=0 | eval t=mvzip(animal,arr,"|") |stats count by t | eval animal=mvindex(split(t,"|"),0),arr="[".mvindex(split(t,"|"),1) |fields - t, count | rex field=arr "\"id\":\s(?<ids>\d)" max_match=0|eval count=mvcount(ids) | table animal count

Thanks
KV
▄︻̷̿┻̿═━一 ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Plotting bar chart X axis are JSON keys and Y axis are length of JSON values

oKeNiDJE — Thu, 22 Jul 2021 15:40:09 GMT

Thanks @kamlesh_vaghela . That would work yes, however, I need the search query to be dynamic because I don't know the keys ahead of time.

Any idea on how to do this?

Re: Plotting bar chart X axis are JSON keys and Y axis are length of JSON values

kamlesh_vaghela — Thu, 22 Jul 2021 16:06:44 GMT

@oKeNiDJE

I have updated my answer. Can you please check it?

Re: Plotting bar chart X axis are JSON keys and Y axis are length of JSON values

oKeNiDJE — Thu, 22 Jul 2021 22:11:30 GMT

This has been super helpful @kamlesh_vaghela ! Thank you so much

Say if you had a JSON object however and didn't want to convert it to a string and use rex, would that be possible?

Re: Plotting bar chart X axis are JSON keys and Y axis are length of JSON values

kamlesh_vaghela — Fri, 23 Jul 2021 04:34:55 GMT

@oKeNiDJE

That you need to POC and check 😅. Coz, Splunk ingest characters / text format and if you ingest Json object then Splunk might be ingest represented value of that object and that might be invalid data for as.

Splunk need valid json string for auto discovery of fields.

So here I suggest keep it in converted string format and use rex for our requirements . 😊

Thanks
KV
▄︻̷̿┻̿═━一 ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.