Splunk Search

How to convert JSON with multiple values for same metric name in to metric points

ankithreddy777
Contributor

I have a sample JSON object containing multiple values for same metric_name which is CPU_usage. How to convert it in to multiple metric points whose metric name is same i.e CPU_usage.

samplejson: [ [-]
{ [-]
epochtime: 1573532862
value: 5.29
}
{ [-]
epochtime: 1573532562
value: 5.34
}

Tags (1)
0 Karma

woodcock
Esteemed Legend

This is best done using jquery tool before it comes into Splunk. The king of jquery and splunk is @mmodestino_splunk so maybe he will also comment.

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval _raw="{ \"samplejson\": [
{
\"epochtime\": 1573532862,
\"value\": 5.29
}, {
\"epochtime\": 1573532562,
\"value\": 5.34
} ] }"
| spath
`comment("this is sample data")`
| eval raw=mvzip('samplejson{}.epochtime','samplejson{}.value')
| table raw
| mvexpand raw
| rex field=raw "(?<_time>[^,]+),(?<CPU_Usage>.+)"

Hi, how about this?

0 Karma

ankithreddy777
Contributor

Hi @to4kawa , I am looking to break events at index time and convert to metric points to store data in metric index

0 Karma

to4kawa
Ultra Champion

OK. I don’t know. I'm sorry.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...