How to Make a Table for JSON Data?

apignata — Mon, 27 Mar 2023 14:18:12 GMT

I have the following JSON structure in my events. I am trying to figure out an SPL Query to format the JSON in a table for a dashboard. The names of the WLCs could change, so WLC-1 will not always be the first entry or have the same name. Is it possible to make a dynamic table like the one below? Thank you.

WLC-1	SSID1: 2	SSID2: 4
WLC-2	SSID1: 16	SSID3: 8
WLC-3	SSID2: 6	SSID3: 6	SSID4: 9

{ 
   WLC-1: { 
     SSID1: 2
     SSID2: 4
   }
   WLC-2: {
     SSID1: 16
     SSID3: 8
   }
   WLC-3: {
     SSID2: 6
     SSID3: 6
     SSID4: 9
   }
}

Re: How to Make a Table for JSON Data

gcusello — Mon, 27 Mar 2023 07:12:46 GMT

Hi @apignata,

you could use the INDEXED_EXTRACTIONS=json option in the props.conf (https://docs.splunk.com/Documentation/Splunk/9.0.4/admin/Propsconf), in this way all the fields are automatically extracted.

In addition you could also use the spath command (https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Spath) that makes the same thing.

Ciao.

Giuseppe

topic How to Make a Table for JSON Data? in Splunk Search

How to Make a Table for JSON Data?

Re: How to Make a Table for JSON Data