Getting Data In

How to have my JSON output data in separate rows and not a single one?

Nadhiyaa
Path Finder

alt text

This is the output of my JSON data. I would want to see it in separate rows and not in a single row.
When I do mvexpand for each time it's taking all the count1 values.

My output should be separate rows with time and count1 value.

0 Karma
1 Solution

niketn
Legend

@Nadhiyaa as explained in my previous answer fields count1 and time need to be zipped together using mvzip() evaluation function. Try the following search based on your data:

  <yourCurrentSearch>
 | table count1 time
 | eval data=mvzip(count1, time) 
 | mvexpand data 
 | makemv data delim="," 
 | eval count1=mvindex(data,0),time=mvindex(data,1) 
 | fields - data
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@Nadhiyaa as explained in my previous answer fields count1 and time need to be zipped together using mvzip() evaluation function. Try the following search based on your data:

  <yourCurrentSearch>
 | table count1 time
 | eval data=mvzip(count1, time) 
 | mvexpand data 
 | makemv data delim="," 
 | eval count1=mvindex(data,0),time=mvindex(data,1) 
 | fields - data
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Nadhiyaa
Path Finder

Yes it worked .
Now i am trying add a trend in a single value format.

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hey @nadhiyaa,

Did @niketnilay help solve your problem? If so, would you approve his answer so that other users know it's legit. Also, could you toss him an upvote? MMM... upvotes.

niketn
Legend

@Nadhiyaa you can call your time field as _time which should take care of showing data over time.

   <yourCurrentSearch>
  | table count1 time
  | eval data=mvzip(count1, time) 
  | mvexpand data 
  | makemv data delim="," 
  | eval count1=mvindex(data,0),_time=mvindex(data,1) 
  | table _time count1

If you want you can also add timechart command with required aggregating function like

 | timechart sum(count1) as Total
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...