Getting Data In

How to have my JSON output data in separate rows and not a single one?

Nadhiyaa
Path Finder

alt text

This is the output of my JSON data. I would want to see it in separate rows and not in a single row.
When I do mvexpand for each time it's taking all the count1 values.

My output should be separate rows with time and count1 value.

0 Karma
1 Solution

niketn
Legend

@Nadhiyaa as explained in my previous answer fields count1 and time need to be zipped together using mvzip() evaluation function. Try the following search based on your data:

  <yourCurrentSearch>
 | table count1 time
 | eval data=mvzip(count1, time) 
 | mvexpand data 
 | makemv data delim="," 
 | eval count1=mvindex(data,0),time=mvindex(data,1) 
 | fields - data
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@Nadhiyaa as explained in my previous answer fields count1 and time need to be zipped together using mvzip() evaluation function. Try the following search based on your data:

  <yourCurrentSearch>
 | table count1 time
 | eval data=mvzip(count1, time) 
 | mvexpand data 
 | makemv data delim="," 
 | eval count1=mvindex(data,0),time=mvindex(data,1) 
 | fields - data
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Nadhiyaa
Path Finder

Yes it worked .
Now i am trying add a trend in a single value format.

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hey @nadhiyaa,

Did @niketnilay help solve your problem? If so, would you approve his answer so that other users know it's legit. Also, could you toss him an upvote? MMM... upvotes.

niketn
Legend

@Nadhiyaa you can call your time field as _time which should take care of showing data over time.

   <yourCurrentSearch>
  | table count1 time
  | eval data=mvzip(count1, time) 
  | mvexpand data 
  | makemv data delim="," 
  | eval count1=mvindex(data,0),_time=mvindex(data,1) 
  | table _time count1

If you want you can also add timechart command with required aggregating function like

 | timechart sum(count1) as Total
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...