Splunk Search

Correlate data in JSON file without timestamp

Patrick_Peeters
Splunk Employee
Splunk Employee

I have a JSON input with different types, all representing a data point at a certain time. I have the start time of the event and am looking for a way to get all the data organised without having to revert to custom Python code - how do I do this?

The 'time' type in JSON depicts how many seconds since the start time a data point is happening across all these types.

Ideally I'm looking for something that looks like this based on the data below assuming the start time is 12:00:00, probably latlng even split but that's secondary for now:

_timedistancealtitudelatlng
12:00:003.851.5
-33.895627151.228228
12:00:015.251.6-33.895627151.228228
12:00:036.751.5-33.895627151.228228
12:00:048.951.5-33.895627151.228228

 

 

[
    {
        "type": "time",
        "data": [
            0,
            1,
            3,
            4
        ]
    }, 
    {
        "type": "distance",
        "data": [
            3.8,
            5.2,
            6.7,
            8.9
        ]
    },
    {
        "type": "altitude",
        "data": [
            51.5,
            51.6,
            51.5,
            51.5
        ]
    },
    {
        "type": "latlng",
        "data": [
            [
                -33.895627,
                151.228228
            ],
            [
                -33.895627,
                151.228228
            ],
            [
                -33.895627,
                151.228228
            ],
            [
                -33.895627,
                151.228228
            ],
        ]
    },
]

 

 

 

0 Karma
1 Solution

Patrick_Peeters
Splunk Employee
Splunk Employee

Managed to get it done via Python's pandas module, specifically pandas.DataFrame function. It works great for series and dataframe data like the one I had.

The result:

 

[
    {
        "time": 1580539600,
        "distance": 0,
        "altitude": 45.7,
        "heartrate": 77,
        "lat": -33.895302,
        "lon": 151.228177
    },
    {
        "time": 1580539601,
        "distance": 0,
        "altitude": 45.7,
        "heartrate": 77,
        "lat": -33.895302,
        "lon": 151.228177
    },
    {
        "time": 1580539602,
        "distance": 0,
        "altitude": 45.7,
        "heartrate": 77,
        "lat": -33.895325,
        "lon": 151.22817
    }
]

 

 

View solution in original post

Tags (3)
0 Karma

Patrick_Peeters
Splunk Employee
Splunk Employee

Managed to get it done via Python's pandas module, specifically pandas.DataFrame function. It works great for series and dataframe data like the one I had.

The result:

 

[
    {
        "time": 1580539600,
        "distance": 0,
        "altitude": 45.7,
        "heartrate": 77,
        "lat": -33.895302,
        "lon": 151.228177
    },
    {
        "time": 1580539601,
        "distance": 0,
        "altitude": 45.7,
        "heartrate": 77,
        "lat": -33.895302,
        "lon": 151.228177
    },
    {
        "time": 1580539602,
        "distance": 0,
        "altitude": 45.7,
        "heartrate": 77,
        "lat": -33.895325,
        "lon": 151.22817
    }
]

 

 

Tags (3)
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...