Getting Data In

How to extract JSON into a chart?

goe
Engager

Hello,

I have JSON string in the following format,

{"status":"503"}

and I would like to create a pie chart with the values of status, the number of occurrences for a time period.

So far I create this and I think I am close,

ERROR | spath output=status path=status | timechart count as "Error" by status
0 Karma
1 Solution

goe
Engager

Hey thanks! I managed to solve it using rex because it's JSON within regular text.

My solution is similiar to this.

But instead of displaying in table I did,

| rex field=_raw "status\":\"(?P<msg>.[^\"\"]*)" | chart count msg

View solution in original post

0 Karma

goe
Engager

Hey thanks! I managed to solve it using rex because it's JSON within regular text.

My solution is similiar to this.

But instead of displaying in table I did,

| rex field=_raw "status\":\"(?P<msg>.[^\"\"]*)" | chart count msg
0 Karma

somesoni2
Revered Legend

@goe, glad you were able to work out your issue. Please accept this answer to close the question. If possible, if you can add the solution (by editing this Answer), that'll help other Splunkers with similar issues.

0 Karma

p_gurav
Champion

Can you try:

| makeresults | eval abc="{\"status\":\"503\"}"  | spath input=abc output=status path=status | timechart count by status
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...