how can i set a variables to each jsonarray object?

ktaeil — Fri, 20 Oct 2023 00:34:05 GMT

_Raw json format is below
{
"test-03": {
"field1": 97869,
"field2": 179771,
"field3": "test-03",
"traffics": 1070140210
},
"test-08": {
"field1": 53094,
"field2": 103840,
"field3": "test-08",
"traffics": 998807234
},
"test-09": {
"field1": 145655,
"field2": 250518,
"field3": "test-09",
"traffics": 2212423288
},
"test-10": {
"field1": 83663,
"field2": 151029,
"field3": "test-10",
"traffics": 762554139
},
"k": 63314
}

when i use timechart avg(test*.traffics) , it works

but number was so huge, so i tried to change |eval test*.traffics=round(test*.traffics/1024,2) but it didnt work.

can anybody help it please

Re: how can i set a variables to each jsonarray object?

yuanliu — Fri, 20 Oct 2023 07:30:17 GMT

You cannot use wildcard group in eval. Use foreach to iterate.

| foreach test-*.traffics [eval <<FIELD>> = round('<<FIELD>>' / 1024, 2)]

topic how can i set a variables to each jsonarray object? in Splunk Search

how can i set a variables to each jsonarray object?

Re: how can i set a variables to each jsonarray object?