Dashboards & Visualizations

JSON string, split in search?

pir8radio
Path Finder

Thanks everyone, you have helped me a lot these last few days as I binge learn splunk... This question, im pretty sure, is an easy one, im just missing something obvious...... I grab JSON values that are a multivalue field so usage_info.voltage contains value1,valu2 Im trying to add value1 and value2 to a dashboard as two different single value displays. How can i modify my search to show one value or the other?

RAW JSON DATA
"voltage":[121.77615356445312,121.19967651367188]

alt text

Labels (1)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
index="sense_power_monitor" | head 1| rename usage_info.voltage{} as voltage |mvexpand voltage | stats values(voltage) by voltage | streamstats count as voltage

Viz >> single value with trellis voltage

View solution in original post

0 Karma

to4kawa
Ultra Champion
index="sense_power_monitor" | head 1| rename usage_info.voltage{} as voltage |mvexpand voltage | stats values(voltage) by voltage | streamstats count as voltage

Viz >> single value with trellis voltage

0 Karma

to4kawa
Ultra Champion

single
I see.

0 Karma

pir8radio
Path Finder

I see, you are using Trellis. I can not use trellis, i need to use regular single value display. no matter what size i pick i can not fit my reading in a trellis view.

alt text

0 Karma

to4kawa
Ultra Champion

you use single value chart.
If you want to display multivalues , use trellis.
i can not fit
why do you append extra unit?

0 Karma

pir8radio
Path Finder

I need high resolution plus unit name. Looks fine in a single value display... Is there no way to filter out one of the two values, so i can display only one value?

0 Karma

to4kawa
Ultra Champion
0 Karma

pir8radio
Path Finder

that just returns "1" and not "121.7713" like i would expect?
remember i'm using a single value display.

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...