Dashboards & Visualizations

How to parse JSON with multiple array to barchart

cuongnguyen112
Engager

hi, i got data like this
{
"source": "sadmin",
"sysinfo": {
"ram": [
{
"name": "ram",
"usage": 1243
},
{
"name": "ram0",
"usage": 1215
},
{
"name": "ram1",
"usage": 2151
}
],
}
}

i need to create a barchart from these data like img below: alt text

Can any one help me please !

Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@cuongnguyen112

Can you please try this?

YOUR_SEARCH  | rename sysinfo.ram{}.* as * | eval tmp =mvzip(name,usage) | mvexpand tmp | eval name=mvindex(split(tmp,","),0),usage=mvindex(split(tmp,","),1) | table name usage

My Sample Search:

| makeresults | eval _raw="{\"source\": \"sadmin\",\"sysinfo\": {\"ram\": [{\"name\": \"ram\",\"usage\": 1243},{\"name\": \"ram0\",\"usage\": 1215},{\"name\": \"ram1\",\"usage\": 2151}],}}" | extract | rename sysinfo.ram{}.* as * | eval tmp =mvzip(name,usage) | mvexpand tmp | eval name=mvindex(split(tmp,","),0),usage=mvindex(split(tmp,","),1) | table name usage

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@cuongnguyen112

Can you please try this?

YOUR_SEARCH  | rename sysinfo.ram{}.* as * | eval tmp =mvzip(name,usage) | mvexpand tmp | eval name=mvindex(split(tmp,","),0),usage=mvindex(split(tmp,","),1) | table name usage

My Sample Search:

| makeresults | eval _raw="{\"source\": \"sadmin\",\"sysinfo\": {\"ram\": [{\"name\": \"ram\",\"usage\": 1243},{\"name\": \"ram0\",\"usage\": 1215},{\"name\": \"ram1\",\"usage\": 2151}],}}" | extract | rename sysinfo.ram{}.* as * | eval tmp =mvzip(name,usage) | mvexpand tmp | eval name=mvindex(split(tmp,","),0),usage=mvindex(split(tmp,","),1) | table name usage

Thanks

View solution in original post

0 Karma

cuongnguyen112
Engager

Thank you, that's totally what is need

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!