topic Re: parse value from json event and build graph in Splunk Search

How to parse value from json event and build graph?

alexeysharkov — Tue, 28 Mar 2023 14:27:36 GMT

Hello gays

I have events like this, in raw text:

{"key":"Pending","value":0}

{"key":"NOT processed","value":9}

{"key":"error","value":5}

...

And so on

Every row is event

I wanna build chart with latest value of "Pending", "NOT processed", :"error"

I cannot understand how to do it

Please help

Re: parse value from json event and build graph

gcusello — Tue, 28 Mar 2023 08:41:02 GMT

Hi @alexeysharkov,

did you alread extracted these fields or not?

if yes, you could run something like this:

<your_search> | stats last(Pending) AS pending last("NOT processed") AS "NOT processed" last(error) AS error

for more infos see at https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Stats

Only one additional information: these seems to be json format logs, but you have them in separated events, maybe you shuld analyze youd data and use a different parsing rule.

Ciao.

Giuseppe

Re: parse value from json event and build graph

alexeysharkov — Tue, 28 Mar 2023 10:56:58 GMT

Thanks @gcusello for your assistance

#did you alread extracted these fields or not? #

Re: parse value from json event and build graph

gcusello — Tue, 28 Mar 2023 11:02:42 GMT

Hi @alexeysharkov,

in this case to give you a complete answer, I need to have some sample of your logs (complete events) to extract ields using regex.

Ciao.

Giuseppe

Re: How to parse value from json event and build graph?

alexeysharkov — Wed, 29 Mar 2023 04:54:17 GMT

thanks @gcusello for your advise

I solve problem :

<search> | timechart cont=false latest(value) as Message_Count by key

Re: How to parse value from json event and build graph?

gcusello — Wed, 29 Mar 2023 06:43:21 GMT

Hi @alexeysharkov,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉