Hi all,
We have some custom JSON data getting into Splunk. We're also creating some dashboard with this data. Everything is working great, except for the dynamic drop down.
In our data, (below), we have JSON coming from two different devices, one has a powerdata of branch1 and another has a powerdata of branch1 and branch2.
What I would like to do is to show or display all selections to the maximum reading like (1,2,34,5,6,7,8 and so on) in powerdata for each branch current in the dropdown.
FYI, look similar to the below link, but I would like to rad the data from powerdata for each branch instead of from the plugcount.
https://answers.splunk.com/answers/748424/how-to-dynamically-fill-in-a-dropdown.html#answer-748429
Looking forward to your help.
Here is the JSON sent to Splunk
{ [-]
assettag: VMR-8HS20-2
ats: 0
branchcount: 1
outletmetering: 1
plugcount: 8
powerdata: [ [-]
{ [-]
branch1: [ [-]
{ [-]
current1: 1.90
voltage1: 120.00
}
]
format: F
temperature: 81
timestamp: 2019-06-19T15:16:10+00:00
}
]
powerdatacount: 1
powereff: 100
powerfactor: 100
powerunit: 1
siteid: LABRACK1
timestamp: 2019-06-19T15:16:10+00:00
}
Here is another JSON sent to Splunk
{ [-]
assettag: CPM-1600-1-ECAM-LAB
ats: 1
branchcount: 2
outletmetering: 1
plugcount: 16
powerdata: [ [-]
{ [-]
branch1: [ [-]
{ [-]
current1: 0.00
current2: 0.20
current3: 0.40
current4: 0.00
current5: 0.00
current6: 0.00
current7: 0.00
current8: 0.00
voltage1: 116.00
}
]
branch2: [ [-]
{ [-]
current1: 0.00
current2: 0.00
current3: 0.00
current4: 0.00
current5: 0.00
current6: 0.00
current7: 0.00
current8: 0.00
voltage1: 114.00
}
]
timestamp: 2019-06-19T15:33:53+00:00
}
]
powerdatacount: 1
powereff: 100
powerfactor: 100
powerunit: 1
siteid: LABRACK1
timestamp: 2019-06-19T15:33:53+00:00
}
Below is the main search query
index="main" | table sourcetype, siteid, assettag, ats, outletmetering, powerunit, branchcount, plugcount, powerdata{}.branch1{}.current1, powerdata{}.branch1{}.current2, powerdata{}.branch1{}.current3, powerdata{}.branch1{}.current4, powerdata{}.branch1{}.current5, powerdata{}.branch1{}.current6, powerdata{}.branch1{}.current7, powerdata{}.branch1{}.current8, powerdata{}.branch1{}.voltage1, powerdata{}.branch2{}.current1, powerdata{}.branch2{}.current2, powerdata{}.branch2{}.current3, powerdata{}.branch2{}.current4, powerdata{}.branch2{}.current5, powerdata{}.branch2{}.current6, powerdata{}.branch2{}.current7, powerdata{}.branch2{}.current8, powerdata{}.branch2{}.voltage1, timestamp, _time | eval Date/Time=_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Date/Time) | eval timestamp=strptime(timestamp, "%Y-%m-%dT%H:%M:%S")| eval timestamp=strftime(timestamp,"%m-%d-%Y %H:%M:%S") | eval release_year = strftime(timestamp_epoc, "%Y") | fillnull value="No Defined" release_year, ats, outletmetering, powerunit, branchcount, plugcount, powerdata{}.branch1{}.current1, powerdata{}.branch1{}.current2, powerdata{}.branch1{}.current3, powerdata{}.branch1{}.current4, powerdata{}.branch1{}.current5, powerdata{}.branch1{}.current6, powerdata{}.branch1{}.current7, powerdata{}.branch1{}.current8, powerdata{}.branch1{}.voltage1, powerdata{}.branch2{}.current1, powerdata{}.branch2{}.current2, powerdata{}.branch2{}.current3, powerdata{}.branch2{}.current4, powerdata{}.branch2{}.current5, powerdata{}.branch2{}.current6, powerdata{}.branch2{}.current7, powerdata{}.branch2{}.current8, powerdata{}.branch2{}.voltage1 | search sourcetype=powerdata