topic Re: How to convert JSON with multiple values for same metric name in to metric points in Splunk Search

How to convert JSON with multiple values for same metric name in to metric points

ankithreddy777 — Wed, 30 Sep 2020 02:56:56 GMT

I have a sample JSON object containing multiple values for same metric_name which is CPU_usage. How to convert it in to multiple metric points whose metric name is same i.e CPU_usage.

samplejson: [ [-]
{ [-]
epochtime: 1573532862
value: 5.29
}
{ [-]
epochtime: 1573532562
value: 5.34
}

Re: How to convert JSON with multiple values for same metric name in to metric points

to4kawa — Sun, 17 Nov 2019 13:09:16 GMT

| makeresults
| eval _raw="{ \"samplejson\": [
{
\"epochtime\": 1573532862,
\"value\": 5.29
}, {
\"epochtime\": 1573532562,
\"value\": 5.34
} ] }"
| spath
`comment("this is sample data")`
| eval raw=mvzip('samplejson{}.epochtime','samplejson{}.value')
| table raw
| mvexpand raw
| rex field=raw "(?<_time>[^,]+),(?<CPU_Usage>.+)"

Hi, how about this?

Re: How to convert JSON with multiple values for same metric name in to metric points

ankithreddy777 — Sun, 17 Nov 2019 14:12:56 GMT

Hi @to4kawa , I am looking to break events at index time and convert to metric points to store data in metric index

Re: How to convert JSON with multiple values for same metric name in to metric points

to4kawa — Sun, 17 Nov 2019 20:20:18 GMT

OK. I don’t know. I'm sorry.

Re: How to convert JSON with multiple values for same metric name in to metric points

woodcock — Sun, 17 Nov 2019 22:12:14 GMT

This is best done using jquery tool before it comes into Splunk. The king of jquery and splunk is @mmodestino_splunk so maybe he will also comment.