Dashboards & Visualizations

Extracting simple array of strings

sankarms
Explorer

I have a simple entry in my logs like so:

types=["A","B","C"]

There are several entries like that throughout the logs. Another one could look like this:

types=["B","C"]

Is there a way to extract the values from this array of strings and create a bar chart out of the occurrences of each type? So if splunk only saw the above 2 long entries it would make a bar chart with

  • "# of occurrences" on the y-axis
  • "Types" on the x-axis

And it would show 1 for type A, 2 for type B and C.

What would be the search criterion?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could cheat by going through spath parsing JSON:

... | eval types = "{\"types\": " + types + "}" | spath input=types | rename types{} as types | stats count by types

Alternatively, a bit of regexing around:

... | eval types = replace(types, "(^\[\")|(\"\]$)", "")| makemv types delim="\",\"" | stats count by types

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You could cheat by going through spath parsing JSON:

... | eval types = "{\"types\": " + types + "}" | spath input=types | rename types{} as types | stats count by types

Alternatively, a bit of regexing around:

... | eval types = replace(types, "(^\[\")|(\"\]$)", "")| makemv types delim="\",\"" | stats count by types

martin_mueller
SplunkTrust
SplunkTrust

What does the statistics table look like, and what visualization are you using?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Odd - what happens when you run this in an empty search bar?

| stats count | eval foo = "types=[\"A\",\"B\",\"C\"] types=[\"B\",\"C\"]" | makemv foo | mvexpand foo | rename foo as _raw | extract | eval types = replace(types, "(^\[\")|(\"\]$)", "")| makemv types delim="\",\"" | stats count by types
0 Karma

sankarms
Explorer

Sorry I'm an absolute idiot. I messed up something from your original command. It works perfectly fine now. Thank you.

0 Karma

sankarms
Explorer

this doesn't extract the individual types separately. This gives back the whole list like so

["A","B","C"]

and counts it as 1 object.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...