i try to retrieve data from influxDB. but I don't know how to parse the result that columns and values are separated.
| makeresults
| eval results= {"series":[{"values":[["2019-10-25T06:02:18.369115741Z","A","1"],["2019-10-25T06:03:33.4004666Z","B","2"],["2019-10-25T06:04:01.104011287Z","C","3"],["2019-10-25T06:04:08.673023079Z","D","4"]],"columns":["time","field","tag"],"name":"test_measurement"}],"statement_id":0}
| ???
can it be transformed into the table below?
|time|field|tag|
|2019-10-25T06:02:18.369115741Z|A|1|
|2019-10-25T06:03:33.4004666Z|B|2|
|2019-10-25T06:04:01.104011287Z|C|3|
|2019-10-25T06:04:08.673023079Z|D|4|
| makeresults
| eval _raw= "{\"series\":[{\"values\":[[\"2019-10-25T06:02:18.369115741Z\",\"A\",\"1\"],[\"2019-10-25T06:03:33.4004666Z\",\"B\",\"2\"],[\"2019-10-25T06:04:01.104011287Z\",\"C\",\"3\"],[\"2019-10-25T06:04:08.673023079Z\",\"D\",\"4\"]],\"columns\":[\"time\",\"field\",\"tag\"],\"name\":\"test_measurement\"}],\"statement_id\":0}"
`comment("this is sample data")`
| spath
| table series*
| foreach series{}.*{}
[rename <<FIELD>> as <<MATCHSTR>>]
| mvexpand values
| streamstats reset_after="match(values,\"\d+$\")" count
| eval field_name=mvindex(columns,count -1)
| streamstats count(eval(field_name=="time")) as tmp
| xyseries tmp field_name values
| table time field tag
Hi, how about this?
did you connect splunkdb with influxdb?
i try it but got error:
https://community.splunk.com/t5/Splunk-Search/driver-influxdb-to-splunk-db/m-p/605850#M210681
would please how do you do this?
Thanks
| makeresults
| eval _raw= "{\"series\":[{\"values\":[[\"2019-10-25T06:02:18.369115741Z\",\"A\",\"1\"],[\"2019-10-25T06:03:33.4004666Z\",\"B\",\"2\"],[\"2019-10-25T06:04:01.104011287Z\",\"C\",\"3\"],[\"2019-10-25T06:04:08.673023079Z\",\"D\",\"4\"]],\"columns\":[\"time\",\"field\",\"tag\"],\"name\":\"test_measurement\"}],\"statement_id\":0}"
`comment("this is sample data")`
| spath
| table series*
| foreach series{}.*{}
[rename <<FIELD>> as <<MATCHSTR>>]
| mvexpand values
| streamstats reset_after="match(values,\"\d+$\")" count
| eval field_name=mvindex(columns,count -1)
| streamstats count(eval(field_name=="time")) as tmp
| xyseries tmp field_name values
| table time field tag
Hi, how about this?
i really appreciate it!!
your welcome, Happy Splunking.