How to parse the result retrieved from influxDB

[u191477]

i try to retrieve data from influxDB. but I don't know how to parse the result that columns and values are separated.

| makeresults
| eval results= {"series":[{"values":[["2019-10-25T06:02:18.369115741Z","A","1"],["2019-10-25T06:03:33.4004666Z","B","2"],["2019-10-25T06:04:01.104011287Z","C","3"],["2019-10-25T06:04:08.673023079Z","D","4"]],"columns":["time","field","tag"],"name":"test_measurement"}],"statement_id":0}
| ???

can it be transformed into the table below?

|time|field|tag|

|2019-10-25T06:02:18.369115741Z|A|1|

|2019-10-25T06:03:33.4004666Z|B|2|

|2019-10-25T06:04:01.104011287Z|C|3|

|2019-10-25T06:04:08.673023079Z|D|4|

[indeed_2000]

@u191477 @to4kawa 

did you connect splunkdb with influxdb?

i try it but got error:

https://community.splunk.com/t5/Splunk-Search/driver-influxdb-to-splunk-db/m-p/605850#M210681

would please how do you do this?

 Thanks

[to4kawa · Accepted solution]

| makeresults 
| eval _raw= "{\"series\":[{\"values\":[[\"2019-10-25T06:02:18.369115741Z\",\"A\",\"1\"],[\"2019-10-25T06:03:33.4004666Z\",\"B\",\"2\"],[\"2019-10-25T06:04:01.104011287Z\",\"C\",\"3\"],[\"2019-10-25T06:04:08.673023079Z\",\"D\",\"4\"]],\"columns\":[\"time\",\"field\",\"tag\"],\"name\":\"test_measurement\"}],\"statement_id\":0}"
`comment("this is sample data")`
| spath
| table series*
| foreach series{}.*{} 
    [rename <<FIELD>> as <<MATCHSTR>>]
| mvexpand values
| streamstats reset_after="match(values,\"\d+$\")" count
| eval field_name=mvindex(columns,count -1)
| streamstats count(eval(field_name=="time")) as tmp
| xyseries tmp field_name values
| table time field tag

Hi, how about this?

[u191477]

i really appreciate it!!

[to4kawa]

your welcome, Happy Splunking.