Splunk Search

Get latest events of json and visualize it to table.

alexeysharkov
Path Finder

Hello friends!

I get JSON like this

{"key":"27.09.2023","value_sum":35476232.82,"value_cnt":2338}

and so on

...

[-]
   key: 29.09.2023
   value_cnt: 2736

   value_sum: 51150570.59
}

аnd row_source like this

10/4/23
1:23:03.000 PM
 
{"key":"27.09.2023","value_sum":35476232.82,"value_cnt":2338}
Show syntax highlighted

 

And i want to get table like this:

dayssumcnt
27.09.202335476232.822338
29.09.202351150570.592736

 

so i have to get latest events and put it to table.

Please help

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats latest(value_sum) ,latest(value_cnt) by key

View solution in original post

alexeysharkov
Path Finder

Sorry i forget to write very important things

I have many events with the same key 

for example:

10/4/23
1:23:03.000 PM
 
{"key":"27.09.2023","value_sum":35476232.82,"value_cnt":2338}
Show syntax highlighted
10/4/23
1:24:03.000 PM
{"key":"27.09.2023","value_sum":35476232.82,"value_cnt":2338}
Show syntax highlighted
10/4/23
1:25:03.000 PM
{"key":"27.09.2023","value_sum":35476232.82,"value_cnt":2338}
Show syntax highlighted

 

...

and for other KEY  for example key":"29.09.2023" many events

 

in the result i want to see only one unique row for KEY

I try to search 

index=hcg_app_damu_prod sourcetype="damu_pays_7d" | spath input=json | table _time, key ,value_sum, value_cnt | stats latest(key), latest(value_sum) ,latest(value_cnt)

 

but it give me just only one row.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats latest(value_sum) ,latest(value_cnt) by key

ITWhisperer
SplunkTrust
SplunkTrust

Do you already have the fields extracted, or are you asking how to extract the fields so you can use them in a table?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

This is rather confusing.  It seems that Splunk already gives you fields "key", "value_sum", and "value_cnt".  You want to rename "key" as "day", "value_sum" as "sum", "value_cnt" as "cnt".  Is that all?  Are you just looking for rename?

| rename "key" as "day", "value_sum" as "sum", "value_cnt" as "cnt"
| table day sum cnt

Something like that.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...