How to draw a table that digests a field which varies differently

[Saer000]

Hi, I wanna plot a table to indicate the scanner status of Gitlab repos in the dashboard, like below: (1 means enabled, 0 means no used).

fullPath	SAST	SAST_IAC	DAST	DEPENDENCY_SCANNING	CONTAINER_SCANNING	SECRET_DETECTION	COVERAGE_FUZZING	API_FUZZING	CLUSTER_IMAGE_SCANNING
repos1	1	0	0	1	0	1	0	0	0
repos2	1	1	1	1	1	1	0	0	0
repos3	1	0	0	1	1	1	1	1	0

And my raw data stream look like below:

{"fullPath": "repos1", "securityScanners": {"available": ["SAST", "SAST_IAC", "DAST", "DEPENDENCY_SCANNING", "CONTAINER_SCANNING", "SECRET_DETECTION", "COVERAGE_FUZZING", "API_FUZZING", "CLUSTER_IMAGE_SCANNING"], "enabled": ["SAST", "DEPENDENCY_SCANNING", "SECRET_DETECTION"], "pipelineRun": ["SAST", "DEPENDENCY_SCANNING", "SECRET_DETECTION"]}}

{"fullPath": "repos2", "securityScanners": {"available": ["SAST", "SAST_IAC", "DAST", "DEPENDENCY_SCANNING", "CONTAINER_SCANNING", "SECRET_DETECTION", "COVERAGE_FUZZING", "API_FUZZING", "CLUSTER_IMAGE_SCANNING"], "enabled": ["SAST", "DEPENDENCY_SCANNING", "SECRET_DETECTION"], "pipelineRun": ["SAST", "DEPENDENCY_SCANNING", "SECRET_DETECTION", "DAST"]}}

Could anyone help me build a search language to achieve the above?

[bowesmana · Accepted solution]

Here is an example using your example data 

| makeresults
| eval x=split("{\"fullPath\": \"repos1\", \"securityScanners\": {\"available\": [\"SAST\", \"SAST_IAC\", \"DAST\", \"DEPENDENCY_SCANNING\", \"CONTAINER_SCANNING\", \"SECRET_DETECTION\", \"COVERAGE_FUZZING\", \"API_FUZZING\", \"CLUSTER_IMAGE_SCANNING\"], \"enabled\": [\"SAST\", \"DEPENDENCY_SCANNING\", \"SECRET_DETECTION\"], \"pipelineRun\": [\"SAST\", \"DEPENDENCY_SCANNING\", \"SECRET_DETECTION\"]}}X{\"fullPath\": \"repos2\", \"securityScanners\": {\"available\": [\"SAST\", \"SAST_IAC\", \"DAST\", \"DEPENDENCY_SCANNING\", \"CONTAINER_SCANNING\", \"SECRET_DETECTION\", \"COVERAGE_FUZZING\", \"API_FUZZING\", \"CLUSTER_IMAGE_SCANNING\"], \"enabled\": [\"SAST\", \"DEPENDENCY_SCANNING\", \"SECRET_DETECTION\"], \"pipelineRun\": [\"SAST\", \"DEPENDENCY_SCANNING\", \"SECRET_DETECTION\", \"DAST\"]}}","X")
| mvexpand x
| rename x as _raw
| spath
| fields - _raw
| rename securityScanners.* as *
| chart values(enabled{}) by fullPath available{}
| foreach * [ eval <<FIELD>>=if("<<MATCHSTR>>"="fullPath", <<FIELD>>, if(isnull(mvfind(<<FIELD>>, "<<MATCHSTR>>")), 0, 1)) ]

The search fragment you need will be the last 3 lines and it assumes that your JSON fields have been extracted based on their JSON names.

[Saer000]

Thanks a lot, it really works on my side.

[richgalloway]

What have you tried so far?  How have those efforts not met expectations?