How to extract JSON into a chart?

[goe]

Hello,

I have JSON string in the following format,

{"status":"503"}

and I would like to create a pie chart with the values of status, the number of occurrences for a time period.

So far I create this and I think I am close,

ERROR | spath output=status path=status | timechart count as "Error" by status

[goe · Accepted solution]

Hey thanks! I managed to solve it using rex because it's JSON within regular text.

My solution is similiar to this.

But instead of displaying in table I did,

| rex field=_raw "status\":\"(?P<msg>.[^\"\"]*)" | chart count msg

[somesoni2]

@goe, glad you were able to work out your issue. Please accept this answer to close the question. If possible, if you can add the solution (by editing this Answer), that'll help other Splunkers with similar issues.

[p_gurav]

Can you try:

| makeresults | eval abc="{\"status\":\"503\"}"  | spath input=abc output=status path=status | timechart count by status