Splunk Search

How to create list data type value from search spl query ?

vivekbs
Splunk Employee
Splunk Employee

section for calculation_window_telemetry in /apps/SA-ITOA/default/savedsearches.conf:

 

 

"""
search = | inputlookup calculation_window_telemetry_lookup | eval zipped = mvzip('kpis.title', 'kpis.search_alert_earliest' , ",") | fields - kpis.title, kpis.search_alert_earliest| mvexpand zipped | eval x = split(zipped,",") | eval kpi_title = mvindex(x, 0) | eval search_alert_earliest = mvindex(x, 1) | fields - x, zipped| eval calculation_window_{search_alert_earliest}_min = 1 | where kpi_title!="ServiceHealthScore" | fields calc* | stats sum(*) as *
"""

 

 

Search Query: 

 

 

"""
| savedsearch calculation_window_telemetry
  | fields calculation_window_1_min calculation_window_5_min calculation_window_15_min calculation_window_1440_min | addtotals
  | rename Total as data.calculationWindowUsage.predefinedWindow.totalCount
  | rename calculation_window_1_min as data.calculationWindowUsage.predefinedWindow.calculationWindowValueCount.calculation_window_1_min
  | rename calculation_window_5_min as data.calculationWindowUsage.predefinedWindow.calculationWindowValueCount.calculation_window_5_min
  | rename calculation_window_15_min as data.calculationWindowUsage.predefinedWindow.calculationWindowValueCount.calculation_window_15_min
  | rename calculation_window_1440_min as data.calculationWindowUsage.predefinedWindow.calculationWindowValueCount.calculation_window_1440_min
  | append [ | savedsearch calculation_window_telemetry
  | fields - calculation_window_1_min calculation_window_5_min calculation_window_15_min calculation_window_1440_min | addtotals
  | rename Total as data.calculationWindowUsage.customWindow.totalCount
  | rename "calculation*" as data.calculationWindowUsage.customWindow.calculationWindowValueCount.calculation*]
  | stats first(*) as * | fillnull | makejson version(string),data.* output=event | table event
"""

 

 

Current output:

 

{
	"data": {
		"calculationWindowUsage": {
			"customWindow": {
				"calculationWindowValueCount": {
					"calculation_window_1260_min": 1,
					"calculation_window_111_min": 1
				},
				"totalCount": 2
			},
			"predefinedWindow": {
				"calculationWindowValueCount": {
					"calculation_window_1440_min": 1,
					"calculation_window_15_min": 1,
					"calculation_window_1_min": 1,
					"calculation_window_5_min": 1
				},
				"totalCount": 4
			}
		}
	}
}

 

 

Expected output:

 

 

{
  "data": {
    "calculationWindowUsage": {
      "customWindow": {
        "calculationWindowValueCount": [{
          "calculation_window_value": 1260,
          "count": 1
        },
        {
          "calculation_window_value": 111,
          "count": 1
        }],
        "total_count": 2
    },
    "predefinedWindow": {
      "calculationWindowValueCount": [{
          "calculation_window_value": 1,
          "count": 1
        },
        {
          "calculation_window_value": 5,
          "count": 1
        },
        {
          "calculation_window_value": 15,
          "count": 1
        },
        {
          "calculation_window_value": 1440,
          "count": 1
        }],
        "total_count": 4,
      }
    }
  }
}

 

 

I required output in list of dictionary, can anyone help me on this.
Thank you.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...