Dashboards & Visualizations

How to create dashboard with Multiple values for a month on x axis?

shahbaz
Engager

Hi, 

I have Json data for github repos in below format 

 

 

{ 
   data: { [-]
     clone_count: 0
     clone_uniques: 0
     view_count: 7
     view_uniques: 4
   }
   date: 2022-06-28
   repository: projectA
}

 

 

this data will be pushed every day for 2 repos , now i want to create a dashboard  which has month on x-axis that shows data of sum(clone_count) sum(view_count) for both 2 repos monthly as shown below data.png

my query is looking like this 

 

 

index=test  source="data" | where repository in ("binary","manifest")
| eval data_date = split(date,"-") | eval data_year=mvindex(data_date,0) | eval data_month=mvindex(data_date,1) | eval current_year=strftime(now(),"%Y")|eval current_month=strftime(now(),"%m")|  spath output=clonecount path=data.clone_count  |spath output=viewcount path=data.view_count | stats  sum(clonecount) as Totalclonecount  ,sum(viewcount) AS Totalviewcount  by repository,data_month

 

 

 

 

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you could try something like this

index=_audit | head 1  
| eval _raw = "{\"data\":{\"clone_count\":0,\"clone_uniques\":0,\"view_count\":7,\"view_uniques\":4},\"date\":\"2022-05-27\",\"repository\":\"projectA\"}|{\"data\":{\"clone_count\":0,\"clone_uniques\":0,\"view_count\":7,\"view_uniques\":4},\"date\":\"2022-05-27\",\"repository\":\"projectB\"}|{\"data\":{\"clone_count\":0,\"clone_uniques\":0,\"view_count\":7,\"view_uniques\":4},\"date\":\"2022-06-28\",\"repository\":\"projectA\"}|{\"data\":{\"clone_count\":0,\"clone_uniques\":0,\"view_count\":7,\"view_uniques\":4},\"date\":\"2022-06-28\",\"repository\":\"projectB\"}"
| eval foo = split(_raw,"|")
| mvexpand foo
| eval _raw = foo
```prepare sample data```
| spath
| rename data.* as *
| eval _time = strptime(date, "%Y-%m-%d")
| timechart span=1mon sum(clone_count) as Total_clone_count sum(view_count) as Total_view_count by repository

 

If you can change your ingestion phase so that you could use json's date as _time you can drop "eval _time ..." part away.

r. Ismo 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...