JSON Data issues

[chiraggl]

observations_statistics: { [-]
risk_vectors: { [-]
botnet_infections: { [-]
average_duration_days: 14.2
count: 45
count_period: year
}
malware_servers: { [-]
average_duration_days: 0
count: 0
count_period: year
}
potentially_exploited: { [+]
}
spam_propagation: { [+]
}
unsolicited_comm: { [+]
}

How can I inherit inner properties and values to get count and count period properties to display a line graph?

[Richfez]

@chiraggl
Did that comment by @kamlesh_vaghela help you? Do you need more assistance?

If you have it solved, great! Let us know, or even write up your own answer and mark this question as answered. And upvote any other things you found handy for that.

If not, then let us know what else you need and maybe we can help!

-Rich

[kamlesh_vaghela]

@chiraggl

If you have valid JSON event then Splunk will extract fields for you. So you can easily get values. Try below search.

YOUR_SEARCH | table "observations_statistics.risk_vectors.botnet_infections.count" "observations_statistics.risk_vectors.botnet_infections.count_period" "observations_statistics.risk_vectors.malware_servers.count" "observations_statistics.risk_vectors.malware_servers.count_period"

Sample

| makeresults | eval _raw="{\"observations_statistics\": {\"risk_vectors\": {\"botnet_infections\": {\"average_duration_days\": \"14.2\",\"count\": \"45\",\"count_period\": \"year\"},\"malware_servers\": {\"average_duration_days\": \"0\",\"count\": \"0\",\"count_period\": \"year\"}}}}"| extract | table "observations_statistics.risk_vectors.botnet_infections.count" "observations_statistics.risk_vectors.botnet_infections.count_period" "observations_statistics.risk_vectors.malware_servers.count" "observations_statistics.risk_vectors.malware_servers.count_period"

After this If you share some valid JSON event and expect output then it will be very helpful for us.