Splunk Search

Extract JSON data to chart

ndkhoiits
Explorer

Today, I have to create a chart from log in json format. The log is something like that:

Expired token in next 3 days {"data":[{"date":"2014-06-25","Site1":100,"Site2":23,"Site3":133},{"date":"2014-06-26","Site1":200,"Site2":223,"Site3":232},{"date":"2014-06-24","Site1":150,"Site2":342,"Site3":422}]}

Output should be a chart (column chart) which contains information about date and number of expired token for each site

The log will show the list of expire token from 3 sites for next 3 days. The json format can be changed to whatever for suitable.

Anyone please help to give me any suggestion.

Tags (3)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi ndkhoiits,

take a look at the docs about the spath command example 3, this will show you how to use spath on JSON logs.

cheers, MuS

0 Karma

MuS
SplunkTrust
SplunkTrust

based on your provided data:

{"data":
[
{"date":"2014-06-25","Name":"Site1":"Count":"100"},
{"date":"2014-06-25","Name":"Site2":"Count":"23"},
{"date":"2014-06-25","Name":"Site3":"Count":"133"}
]
}

0 Karma

ndkhoiits
Explorer

Would you like to give me a clear explanation or a sample

0 Karma

MuS
SplunkTrust
SplunkTrust

still no need for mvzip because you have per date a Site1, Site2 and Site3 entry. Personally I would add a Name=Site[1|2|3] key=value pair and a count=value per date in the JSON, much easier to handle

0 Karma

ndkhoiits
Explorer

This example is my real world data

0 Karma

MuS
SplunkTrust
SplunkTrust

your sites names are Site1, Site2 and Site3 in the example JSON, so no need for mvzip... or are those site names all equal and this example is your real world data?

0 Karma

ndkhoiits
Explorer

Thanks for your answer, however in my requirement there are 3 sites which need to be included in the report, so I don't know how to use mvzip in this case

0 Karma

ndkhoiits
Explorer
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...

Keep the Learning Going with the New Best of .conf Hub

Hello Splunkers, With .conf26 getting closer, there’s already a lot of excitement building around this year’s ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...