Splunk Search

How to Make a Table for JSON Data?

apignata
Explorer

I have the following JSON structure in my events. I am trying to figure out an SPL Query to format the JSON in a table for a dashboard. The names of the WLCs could change, so WLC-1 will not always be the first entry or have the same name. Is it possible to make a dynamic table like the one below? Thank you.

WLC-1 SSID1: 2 SSID2: 4  
WLC-2 SSID1: 16 SSID3: 8  
WLC-3 SSID2: 6 SSID3: 6 SSID4: 9

 

{ 
WLC-1: {
SSID1: 2
SSID2: 4
}
WLC-2: {
SSID1: 16
SSID3: 8
}
WLC-3: {
SSID2: 6
SSID3: 6
SSID4: 9
}
}

 

 

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @apignata,

you could use the INDEXED_EXTRACTIONS=json option in the props.conf (https://docs.splunk.com/Documentation/Splunk/9.0.4/admin/Propsconf), in this way all the fields are automatically extracted.

In addition you could also use the spath command (https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Spath) that makes the same thing.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...