topic What is the best solution to table list of keys which can be eventually used for input dropdown in dashboard? in Splunk Search

What is the best solution to table list of keys which can be eventually used for input dropdown in dashboard?

kirangurram — Wed, 17 Aug 2022 16:53:16 GMT

Hello Folks ,

I have json data in below format. I am looking for a best solution to table list of Keys which can be eventually used for input dropdown in dashboard.

output of the table content needs to be like below. your help is much appreciated.

bzk.f1

bzk.f4

bzk.f8

{ [-]
   bzk: { [-]
     f1: ABC
     f4: ABC
     f8: ABC
}

}

Re: What is the best solution to table list of keys which can be eventually used for input dropdown in dashboard?

ITWhisperer — Wed, 17 Aug 2022 16:55:17 GMT

| spath | fields - _time _raw | transpose column_name=name | fields name

Re: What is the best solution to table list of keys which can be eventually used for input dropdown in dashboard?

yuanliu — Thu, 18 Aug 2022 09:03:17 GMT

So, your data already contain fields named bzk.f1, bzk.f4, etc. The following should give you a single-field table:

| foreach bzk.* [eval inputfield = mvappend(inputfield, "<<FIELD>>")] | table inputfield

Alternatively, you can use spath together with the newer JSON functions

| spath input=data path=bzk | eval inputfield = json_array_to_mv(json_keys(bzk)) | eval inputfield = mvmap(inputfield, "bzk." . inputfield) | table inputfield