Dashboards & Visualizations

Drawing graph for dynamic key and value

adr2609
Engager

My Splunk Objects looks like this:-

Obj1:-
{
    time: x1
    type:"info"
    data: {
        0:12
        1:13
        2:12
        3:17
    }
}

Obj2:-
{
    time: x1
    type:"info"
    data: {
        4:16
        5:12
        6:14
        7:19
    }
}

I want to draw a timechart with key as data.* and value as value(data.*)

I tried using this query

 type=info  | timechart  values(data.0) as 0, values(data.1) as 1, values(data.2) as 2, values(data.3) as 3, values(data.4) as 4, values(data.5) as 5, values(data.6) as 6, values(data.7) as 7

and this worked fine for me.
But I want to extend this query to number 'n' and avoid having multiple values(attrs.x) as x

Is there a simpler way to do it?

0 Karma
1 Solution

renjith_nair
Legend

@adr2609,

timechart  values(data.*) as *
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@adr2609,

timechart  values(data.*) as *
---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...