Dashboards & Visualizations

Same key with different value and want to create a dashboard using those data.

apple4life
New Member

Here is a sample of my event:

  1. type=time1, value = 100, type=time2, value = 200, type=time3, value = 150
  2. type=time1, value = 120, type=time2, value = 300, type=time3, value = 100

The key is repeated multiple times but it may have different values. The order is guaranteed.

How can I create a graph based on these events?

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi apple4life,

you can achieve this in a search by using this nice eval feature shown in this run everywhere command:

 | gentimes start=-1 | eval type="time1", value="100" | eval {type}=value | table time*

It will use the value of the field type as new field name and the value of the field value as its value.

You can do the same in props.conf and transforms.conf as well:

props.conf

[sourcetype here]
REPORT-getmynewfields = getmynewfieldsformmydata

transforms.conf

[getmynewfieldsformmydata]
REGEX  = type=([^,]+),\svalue\s=\s([^,]+)
FORMAT = $1::$2

This will do the same based on the regex.
The configs must be placed on the search head, because it is a search time field extraction.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi apple4life,

you can achieve this in a search by using this nice eval feature shown in this run everywhere command:

 | gentimes start=-1 | eval type="time1", value="100" | eval {type}=value | table time*

It will use the value of the field type as new field name and the value of the field value as its value.

You can do the same in props.conf and transforms.conf as well:

props.conf

[sourcetype here]
REPORT-getmynewfields = getmynewfieldsformmydata

transforms.conf

[getmynewfieldsformmydata]
REGEX  = type=([^,]+),\svalue\s=\s([^,]+)
FORMAT = $1::$2

This will do the same based on the regex.
The configs must be placed on the search head, because it is a search time field extraction.

Hope this helps ...

cheers, MuS

sundareshr
Legend

Try this

 | rex max_match=0 "type=(?<type>[^\,]+)" | rex max_match=0 "value\s=\s(?<val>[^\,]+)" | eval z=mvzip(type, val) | mvexpand z | rex field=z "(?<type>[^\,]+)\,(?<val>.*)" | stats avg(val) as value by type

Just thought of one more approach

... | extract mv_add=t pairdelim="," kvdelim="=" | eval z=mvzip(type, value) | mvexpand z | rex field=z "(?<type>[^\,]+)\,(?<val>.*)" | stats avg(val) as value by type
0 Karma

MuS
SplunkTrust
SplunkTrust

This happens when it takes you too long to type an answer 😉 meanwhile someone else comes up with one 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...