Dashboards & Visualizations

How to separate multiple results in one line ?

mah
Contributor

Hi,

I have a table like this : 3 column minimum :

mah_0-1604913285996.png

The problem is that I want a table which is showing results in separate lines like : 

name targetUrltime
loading...htthps://...942
/servicedesk/.../user/...htthps://...5194
/servicedesk/customer/...htthps://...1447

 

I tried a stats commands like : 

|stats count by name targetUrl Time 

but the result gave me that : 

name targetUrltime
loading...htthps://...1447
/servicedesk/.../user/...htthps://...1447
/servicedesk/customer/...htthps://...1447

 

Can you help me please ?

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
Legend

Did you use spath to split the json or was it done when the event was indexed?

The issue can be resolved by splitting the parsing of the json into two parts. First to get the actions list, then to split each action. By putting a mvexpand between the two you can separate each action into a different line

| makeresults | eval _raw="{
\"actions\" : [{
\"targetUrl\":\"https://..\",
\"Time\":942,
\"name\":\"loading\"},
{
\"targetUrl\":\"https://..\",
\"Time\":5194,
\"name\":\"/servicedesk/\"},
{
\"targetUrl\":\"https://..\",
\"Time\":1447,
\"name\":\"/servicedesk/customer\"}]
}"
| spath path=actions{} output=actions
| fields - _raw
| mvexpand actions
| spath input=actions
| fields - actions

View solution in original post

ITWhisperer
Legend

It might be easier to not have multi-values in the first place. Can you show more of your query for your original table to show how the multi-value fields are being generated?

0 Karma

mah
Contributor

The query is very simple : 

Index=A sourcetype=B Type=C | table name targetUrl Time

for the example of a log, I filtered on one user that did 3 actions :

actions: [ [-] 
     {  [-] 

targetUrl:  https...    

Time942

name : loading 
     }

     {  [-] 

targetUrlhttps://.. .     

Time5194

name : /servicedesk/...
     }

 {  [-] 

targetUrlhttps...    

Time: 1447

name : /servicedesk/customer
     }
   ]

}

The actions are in a list [] in the json and I think that is causing the issue to group in one line, no ?

0 Karma

ITWhisperer
Legend

Did you use spath to split the json or was it done when the event was indexed?

The issue can be resolved by splitting the parsing of the json into two parts. First to get the actions list, then to split each action. By putting a mvexpand between the two you can separate each action into a different line

| makeresults | eval _raw="{
\"actions\" : [{
\"targetUrl\":\"https://..\",
\"Time\":942,
\"name\":\"loading\"},
{
\"targetUrl\":\"https://..\",
\"Time\":5194,
\"name\":\"/servicedesk/\"},
{
\"targetUrl\":\"https://..\",
\"Time\":1447,
\"name\":\"/servicedesk/customer\"}]
}"
| spath path=actions{} output=actions
| fields - _raw
| mvexpand actions
| spath input=actions
| fields - actions

View solution in original post

mah
Contributor

That exactly what I was looking for. 

Works perfectly ! 

Thank you very much !

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!