Splunk Search

How to create list data type value from search spl query ?

vivekbs
Splunk Employee
Splunk Employee

section for calculation_window_telemetry in /apps/SA-ITOA/default/savedsearches.conf:

 

 

"""
search = | inputlookup calculation_window_telemetry_lookup | eval zipped = mvzip('kpis.title', 'kpis.search_alert_earliest' , ",") | fields - kpis.title, kpis.search_alert_earliest| mvexpand zipped | eval x = split(zipped,",") | eval kpi_title = mvindex(x, 0) | eval search_alert_earliest = mvindex(x, 1) | fields - x, zipped| eval calculation_window_{search_alert_earliest}_min = 1 | where kpi_title!="ServiceHealthScore" | fields calc* | stats sum(*) as *
"""

 

 

Search Query: 

 

 

"""
| savedsearch calculation_window_telemetry
  | fields calculation_window_1_min calculation_window_5_min calculation_window_15_min calculation_window_1440_min | addtotals
  | rename Total as data.calculationWindowUsage.predefinedWindow.totalCount
  | rename calculation_window_1_min as data.calculationWindowUsage.predefinedWindow.calculationWindowValueCount.calculation_window_1_min
  | rename calculation_window_5_min as data.calculationWindowUsage.predefinedWindow.calculationWindowValueCount.calculation_window_5_min
  | rename calculation_window_15_min as data.calculationWindowUsage.predefinedWindow.calculationWindowValueCount.calculation_window_15_min
  | rename calculation_window_1440_min as data.calculationWindowUsage.predefinedWindow.calculationWindowValueCount.calculation_window_1440_min
  | append [ | savedsearch calculation_window_telemetry
  | fields - calculation_window_1_min calculation_window_5_min calculation_window_15_min calculation_window_1440_min | addtotals
  | rename Total as data.calculationWindowUsage.customWindow.totalCount
  | rename "calculation*" as data.calculationWindowUsage.customWindow.calculationWindowValueCount.calculation*]
  | stats first(*) as * | fillnull | makejson version(string),data.* output=event | table event
"""

 

 

Current output:

 

{
	"data": {
		"calculationWindowUsage": {
			"customWindow": {
				"calculationWindowValueCount": {
					"calculation_window_1260_min": 1,
					"calculation_window_111_min": 1
				},
				"totalCount": 2
			},
			"predefinedWindow": {
				"calculationWindowValueCount": {
					"calculation_window_1440_min": 1,
					"calculation_window_15_min": 1,
					"calculation_window_1_min": 1,
					"calculation_window_5_min": 1
				},
				"totalCount": 4
			}
		}
	}
}

 

 

Expected output:

 

 

{
  "data": {
    "calculationWindowUsage": {
      "customWindow": {
        "calculationWindowValueCount": [{
          "calculation_window_value": 1260,
          "count": 1
        },
        {
          "calculation_window_value": 111,
          "count": 1
        }],
        "total_count": 2
    },
    "predefinedWindow": {
      "calculationWindowValueCount": [{
          "calculation_window_value": 1,
          "count": 1
        },
        {
          "calculation_window_value": 5,
          "count": 1
        },
        {
          "calculation_window_value": 15,
          "count": 1
        },
        {
          "calculation_window_value": 1440,
          "count": 1
        }],
        "total_count": 4,
      }
    }
  }
}

 

 

I required output in list of dictionary, can anyone help me on this.
Thank you.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...