Getting Data In

JSON Data issues

chiraggl
Engager

observations_statistics: { [-]
risk_vectors: { [-]
botnet_infections: { [-]
average_duration_days: 14.2
count: 45
count_period: year
}
malware_servers: { [-]
average_duration_days: 0
count: 0
count_period: year
}
potentially_exploited: { [+]
}
spam_propagation: { [+]
}
unsolicited_comm: { [+]
}

How can I inherit inner properties and values to get count and count period properties to display a line graph?

Tags (3)
0 Karma

Richfez
SplunkTrust
SplunkTrust

@chiraggl
Did that comment by @kamlesh_vaghela help you? Do you need more assistance?

If you have it solved, great! Let us know, or even write up your own answer and mark this question as answered. And upvote any other things you found handy for that.

If not, then let us know what else you need and maybe we can help!

-Rich

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@chiraggl

If you have valid JSON event then Splunk will extract fields for you. So you can easily get values. Try below search.

YOUR_SEARCH | table "observations_statistics.risk_vectors.botnet_infections.count" "observations_statistics.risk_vectors.botnet_infections.count_period" "observations_statistics.risk_vectors.malware_servers.count" "observations_statistics.risk_vectors.malware_servers.count_period"

Sample

| makeresults | eval _raw="{\"observations_statistics\": {\"risk_vectors\": {\"botnet_infections\": {\"average_duration_days\": \"14.2\",\"count\": \"45\",\"count_period\": \"year\"},\"malware_servers\": {\"average_duration_days\": \"0\",\"count\": \"0\",\"count_period\": \"year\"}}}}"| extract | table "observations_statistics.risk_vectors.botnet_infections.count" "observations_statistics.risk_vectors.botnet_infections.count_period" "observations_statistics.risk_vectors.malware_servers.count" "observations_statistics.risk_vectors.malware_servers.count_period"

After this If you share some valid JSON event and expect output then it will be very helpful for us.

0 Karma