Create a Table and build a dashboard from the tabular data

[Biswadeep]

Hi,

I need some help in creating a table from the below json events. Can someone please help me on that?

The table columns be like 'Name' and 'Count' and Name should hold "cruice", "crpice" etc. and Count should have the corresponding values. Any help would be appreciated. Thanks

11/7/23 9:04:23.616 PM	"Year": { host = iapp6373.howard.ms.com source = /tmp/usage_snapshot.json sourcetype = tsproid_prod.db2ts_log_generator:app
	11/7/23 9:04:23.616 PM	"Top30RequesterInOneYear": { host = iapp6373.howard.ms.com source = /tmp/usage_snapshot.json sourcetype = tsproid_prod.db2ts_log_generator:app
	11/7/23 9:04:23.616 PM	"cruice": 2289449, host = iapp6373.howard.ms.com source = /tmp/usage_snapshot.json sourcetype = tsproid_prod.db2ts_log_generator:app
	11/7/23 9:04:23.616 PM	"crpice": 1465846, host = iapp6373.howard.ms.com source = /tmp/usage_snapshot.json sourcetype = tsproid_prod.db2ts_log_generator:app
	11/7/23 9:04:23.616 PM	"zathena": 1017289, host = iapp6373.howard.ms.com source = /tmp/usage_snapshot.json sourcetype = tsproid_prod.db2ts_log_generator:app
	11/7/23 9:04:23.616 PM	"qrecon": 864252, host = iapp6373.howard.ms.com source = /tmp/usage_snapshot.json sourcetype = tsproid_prod.db2ts_log_generator:app

[ITWhisperer]

This looks like you have multiple events when they should be one?

If so, do all the events that should be together have the same timestamp (_time)?

Ideally, you should fix the ingest so that your events are broken up correctly, i.e. not just by new lines, but by new lines followed by the starting pattern of the event.

Either way, please can you share some sample raw events in a code block to preserve formatting.