Getting Data In

How do I create visualizations using JSON data?

angshul
Path Finder

I have some log files which I'm serializing into a JSON object and sending it to a Splunk App dashboard (through HTTP Event Collector).
The data is displayed on the dashboard as shown below:
data: { [-]
b1: FDh

b2345: 00 00 00 00
eid: 31h

msg: 00h

serialNo: 1
sev: 00h

sid: 03h

sta: FEh

timeStamp: 2019-04-29T12:55:46
}
(I don't have any files that I can upload and perform searching. I'm using code to read some text files and converting them to JSON which is directly sent to the Splunk server)
Is there a way to create graphs/charts using this data on the dashboard?

0 Karma

woodcock
Esteemed Legend

If you set KV_MODE = json in props.conf for your sourcetype, all the fields should be available for you to use and dashboard upon.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...