Splunk Search

How to put data in table format

chaitu1231
New Member

Name :Test
"extensionData": {
"entries": [
{
"key": "machinesTotal",
"value": {
"type": "integer",
"value": 7
}
},
{
"key": "endpoint",
"value": {
"type": "string",
"value": "vcenter.local"
}
},
{
"key": "quotaAllocatedPercentage",
"value": {
"type": "string",
"value": "27% (6 of 22)"
}
},
{
"key": "storageUsed",
"value": {
"type": "integer",
"value": 1006
}
},
{
"key": "machinesAllocatedPercentage",
"value": {
"type": "string",
"value": "86% (6 of 7)"
}
},
{
"key": "memoryAllocatedPercentage",
"value": {
"type": "string",
"value": "20% (72 GB of 352 GB)"
}
},
{
"key": "computeResource",
"value": {
"type": "string",
"value": "Data-Cluster"
}
},
{
"key": "storageAllocatedPercentage",
"value": {
"type": "string",
"value": "23% (1006 GB of 4400 GB)"
}
},
{
"key": "storageUsedPercentage",
"value": {
"type": "string",
"value": "23% (1006 GB of 4400 GB)"
}
}
]
}
}

I need data in table format. Can you help me on this.
alt text

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults count =1 
| eval _raw = "
 {
   \"Name\": \"Test\",
   \"extensionData\": {
     \"entries\": [
       {
         \"key\": \"machinesTotal\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 7
         }
       },
       {
         \"key\": \"endpoint\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"vcenter.local\"
                                                                                             }
       },
       {
         \"key\": \"quotaAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"27% (6 of 22)\"
                                                                                             }
       },
       {
         \"key\": \"storageUsed\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 1006
         }
       },
       {
         \"key\": \"machinesAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"86% (6 of 7)\"
                                                                                             }
       },
       {
         \"key\": \"memoryAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"20% (72 GB of 352 GB)\"
                                                                                             }
       },
       {
         \"key\": \"computeResource\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"Data-Cluster\"
                                                                                             }
       },
       {
         \"key\": \"storageAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                             }
       },
       {
         \"key\": \"storageUsedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                             }
       }
     ]
   }
 }" 
| spath path=extensionData.entries{}.key output=key 
| spath path=extensionData.entries{}.value.value output=value 
| spath path=Name output=Name 
| eval key_value_combined=mvzip(key,value) 
| stats values(Name) as Name by key_value_combined 
| eval key_value= split(key_value_combined,",") 
| eval key=mvindex(key_value,0),value=mvindex(key_value,1) 
| chart values(value) as value over Name by key

or

| makeresults count =1 
| eval _raw = "
 {
   \"Name\": \"Test\",
   \"extensionData\": {
     \"entries\": [
       {
         \"key\": \"machinesTotal\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 7
         }
       },
       {
         \"key\": \"endpoint\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"vcenter.local\"
                                                                                                         }
       },
       {
         \"key\": \"quotaAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"27% (6 of 22)\"
                                                                                                         }
       },
       {
         \"key\": \"storageUsed\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 1006
         }
       },
       {
         \"key\": \"machinesAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"86% (6 of 7)\"
                                                                                                         }
       },
       {
         \"key\": \"memoryAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"20% (72 GB of 352 GB)\"
                                                                                                         }
       },
       {
         \"key\": \"computeResource\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"Data-Cluster\"
                                                                                                         }
       },
       {
         \"key\": \"storageAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                                         }
       },
       {
         \"key\": \"storageUsedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                                         }
       }
     ]
   }
 }" 
| spath path=extensionData.entries{}.key output=key 
| spath path=extensionData.entries{}.value.value output=value 
| spath path=Name output=Name 
| eval key_value_combined=mvzip(key,value) 
| stats values(Name) as Name by key_value_combined 
| eval key_value= split(key_value_combined,",") 
| eval key=mvindex(key_value,0),value=mvindex(key_value,1) 
| eval {key}=value 
| stats values(*) as * 
| fields - key value key_value key_value_combined

tauliang
Communicator

Something like this?

| makeresults  count =1
| eval _raw = "
{
  \"Name\": \"Test\",
  \"extensionData\": {
    \"entries\": [
      {
        \"key\": \"machinesTotal\",
        \"value\": {
          \"type\": \"integer\",
          \"value\": 7
        }
      },
      {
        \"key\": \"endpoint\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"vcenter.local\"
        }
      },
      {
        \"key\": \"quotaAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"27% (6 of 22)\"
        }
      },
      {
        \"key\": \"storageUsed\",
        \"value\": {
          \"type\": \"integer\",
          \"value\": 1006
        }
      },
      {
        \"key\": \"machinesAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"86% (6 of 7)\"
        }
      },
      {
        \"key\": \"memoryAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"20% (72 GB of 352 GB)\"
        }
      },
      {
        \"key\": \"computeResource\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"Data-Cluster\"
        }
      },
      {
        \"key\": \"storageAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"23% (1006 GB of 4400 GB)\"
        }
      },
      {
        \"key\": \"storageUsedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"23% (1006 GB of 4400 GB)\"
        }
      }
    ]
  }
}"

| spath
| rename extensionData.entries{}.key as key
| rename extensionData.entries{}.value.type as type
| rename extensionData.entries{}.value.value as value
| eval zipped=mvzip( key, mvzip( type, value ) )
| mvexpand zipped
| eval zipped=split( zipped, "," )
| eval key=mvindex( zipped, 0 )
| eval type=mvindex( zipped, 1 )
| eval value =mvindex( zipped, 2 )
| table key,value
| transpose
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...