JSON string, split in search?

[pir8radio]

Thanks everyone, you have helped me a lot these last few days as I binge learn splunk... This question, im pretty sure, is an easy one, im just missing something obvious...... I grab JSON values that are a multivalue field so usage_info.voltage contains value1,valu2 Im trying to add value1 and value2 to a dashboard as two different single value displays. How can i modify my search to show one value or the other?

RAW JSON DATA
"voltage":[121.77615356445312,121.19967651367188]

[to4kawa · Accepted solution]

index="sense_power_monitor" | head 1| rename usage_info.voltage{} as voltage |mvexpand voltage | stats values(voltage) by voltage | streamstats count as voltage

Viz >> single value with trellis voltage

[to4kawa]

I see.

[pir8radio]

I see, you are using Trellis. I can not use trellis, i need to use regular single value display. no matter what size i pick i can not fit my reading in a trellis view.

[to4kawa]

you use single value chart.
If you want to display multivalues , use trellis.
i can not fit
why do you append extra unit?

[pir8radio]

I need high resolution plus unit name. Looks fine in a single value display... Is there no way to filter out one of the two values, so i can display only one value?

[to4kawa]

https://answers.splunk.com/answers/819450/how-to-display-2-numbers-on-in-the-same-single-val.html

this is single , too.

[pir8radio]

that just returns "1" and not "121.7713" like i would expect?
remember i'm using a single value display.