Dashboards & Visualizations

JSON string, split in search?

pir8radio
Path Finder

Thanks everyone, you have helped me a lot these last few days as I binge learn splunk... This question, im pretty sure, is an easy one, im just missing something obvious...... I grab JSON values that are a multivalue field so usage_info.voltage contains value1,valu2 Im trying to add value1 and value2 to a dashboard as two different single value displays. How can i modify my search to show one value or the other?

RAW JSON DATA
"voltage":[121.77615356445312,121.19967651367188]

alt text

Labels (1)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
index="sense_power_monitor" | head 1| rename usage_info.voltage{} as voltage |mvexpand voltage | stats values(voltage) by voltage | streamstats count as voltage

Viz >> single value with trellis voltage

View solution in original post

0 Karma

to4kawa
Ultra Champion
index="sense_power_monitor" | head 1| rename usage_info.voltage{} as voltage |mvexpand voltage | stats values(voltage) by voltage | streamstats count as voltage

Viz >> single value with trellis voltage

0 Karma

to4kawa
Ultra Champion

single
I see.

0 Karma

pir8radio
Path Finder

I see, you are using Trellis. I can not use trellis, i need to use regular single value display. no matter what size i pick i can not fit my reading in a trellis view.

alt text

0 Karma

to4kawa
Ultra Champion

you use single value chart.
If you want to display multivalues , use trellis.
i can not fit
why do you append extra unit?

0 Karma

pir8radio
Path Finder

I need high resolution plus unit name. Looks fine in a single value display... Is there no way to filter out one of the two values, so i can display only one value?

0 Karma

to4kawa
Ultra Champion
0 Karma

pir8radio
Path Finder

that just returns "1" and not "121.7713" like i would expect?
remember i'm using a single value display.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...