I have a simple entry in my logs like so:
types=["A","B","C"]
There are several entries like that throughout the logs. Another one could look like this:
types=["B","C"]
Is there a way to extract the values from this array of strings and create a bar chart out of the occurrences of each type? So if splunk only saw the above 2 long entries it would make a bar chart with
And it would show 1 for type A, 2 for type B and C.
What would be the search criterion?
You could cheat by going through spath
parsing JSON:
... | eval types = "{\"types\": " + types + "}" | spath input=types | rename types{} as types | stats count by types
Alternatively, a bit of regexing around:
... | eval types = replace(types, "(^\[\")|(\"\]$)", "")| makemv types delim="\",\"" | stats count by types
You could cheat by going through spath
parsing JSON:
... | eval types = "{\"types\": " + types + "}" | spath input=types | rename types{} as types | stats count by types
Alternatively, a bit of regexing around:
... | eval types = replace(types, "(^\[\")|(\"\]$)", "")| makemv types delim="\",\"" | stats count by types
What does the statistics table look like, and what visualization are you using?
Odd - what happens when you run this in an empty search bar?
| stats count | eval foo = "types=[\"A\",\"B\",\"C\"] types=[\"B\",\"C\"]" | makemv foo | mvexpand foo | rename foo as _raw | extract | eval types = replace(types, "(^\[\")|(\"\]$)", "")| makemv types delim="\",\"" | stats count by types
Sorry I'm an absolute idiot. I messed up something from your original command. It works perfectly fine now. Thank you.
this doesn't extract the individual types separately. This gives back the whole list like so
["A","B","C"]
and counts it as 1 object.