Splunk Search

How to parse value from json event and build graph?

alexeysharkov
Path Finder

Hello gays

I have events like this, in raw text:

{"key":"Pending","value":0}

{"key":"NOT processed","value":9}

{"key":"error","value":5}

...

And so on

Every row is event

I wanna build chart with latest value of "Pending", "NOT processed", :"error"

I cannot understand how to do it

Please help

 

 

 

Labels (2)
0 Karma

alexeysharkov
Path Finder

thanks @gcusello for your advise

I solve problem :

<search> | timechart cont=false latest(value) as Message_Count by key

 

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @alexeysharkov,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated :winking_face:

0 Karma

alexeysharkov
Path Finder

Thanks @gcusello for your assistance

#did you alread extracted these fields or not? #

No

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @alexeysharkov,

in this case to give you a complete answer, I need to have some sample of your logs (complete events) to extract ields using regex.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @alexeysharkov,

did you alread extracted these fields or not?

if yes, you could run something like this:

<your_search>
| stats 
   last(Pending) AS pending
   last("NOT processed") AS "NOT processed"
   last(error) AS error

for more infos see at https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Stats 

Only one additional information: these seems to be json format logs, but you have them in separated events, maybe you shuld analyze youd data and use a different parsing rule.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...