Getting Data In
Highlighted

How to parse the result retrieved from influxDB

New Member

i try to retrieve data from influxDB. but I don't know how to parse the result that columns and values are separated.

| makeresults
| eval results= {"series":[{"values":[["2019-10-25T06:02:18.369115741Z","A","1"],["2019-10-25T06:03:33.4004666Z","B","2"],["2019-10-25T06:04:01.104011287Z","C","3"],["2019-10-25T06:04:08.673023079Z","D","4"]],"columns":["time","field","tag"],"name":"test_measurement"}],"statement_id":0}
| ???

can it be transformed into the table below?

|time|field|tag|

|2019-10-25T06:02:18.369115741Z|A|1|

|2019-10-25T06:03:33.4004666Z|B|2|

|2019-10-25T06:04:01.104011287Z|C|3|

|2019-10-25T06:04:08.673023079Z|D|4|

Tags (3)
0 Karma
Highlighted

Re: How to parse the result retrieved from influxDB

Ultra Champion
| makeresults 
| eval _raw= "{\"series\":[{\"values\":[[\"2019-10-25T06:02:18.369115741Z\",\"A\",\"1\"],[\"2019-10-25T06:03:33.4004666Z\",\"B\",\"2\"],[\"2019-10-25T06:04:01.104011287Z\",\"C\",\"3\"],[\"2019-10-25T06:04:08.673023079Z\",\"D\",\"4\"]],\"columns\":[\"time\",\"field\",\"tag\"],\"name\":\"test_measurement\"}],\"statement_id\":0}"
`comment("this is sample data")`
| spath
| table series*
| foreach series{}.*{} 
    [rename <<FIELD>> as <<MATCHSTR>>]
| mvexpand values
| streamstats reset_after="match(values,\"\d+$\")" count
| eval field_name=mvindex(columns,count -1)
| streamstats count(eval(field_name=="time")) as tmp
| xyseries tmp field_name values
| table time field tag

Hi, how about this?

View solution in original post

0 Karma
Highlighted

Re: How to parse the result retrieved from influxDB

New Member

i really appreciate it!!

0 Karma
Highlighted

Re: How to parse the result retrieved from influxDB

Ultra Champion

your welcome, Happy Splunking.

0 Karma