Splunk Search

How to put data in table format

chaitu1231
New Member

Name :Test
"extensionData": {
"entries": [
{
"key": "machinesTotal",
"value": {
"type": "integer",
"value": 7
}
},
{
"key": "endpoint",
"value": {
"type": "string",
"value": "vcenter.local"
}
},
{
"key": "quotaAllocatedPercentage",
"value": {
"type": "string",
"value": "27% (6 of 22)"
}
},
{
"key": "storageUsed",
"value": {
"type": "integer",
"value": 1006
}
},
{
"key": "machinesAllocatedPercentage",
"value": {
"type": "string",
"value": "86% (6 of 7)"
}
},
{
"key": "memoryAllocatedPercentage",
"value": {
"type": "string",
"value": "20% (72 GB of 352 GB)"
}
},
{
"key": "computeResource",
"value": {
"type": "string",
"value": "Data-Cluster"
}
},
{
"key": "storageAllocatedPercentage",
"value": {
"type": "string",
"value": "23% (1006 GB of 4400 GB)"
}
},
{
"key": "storageUsedPercentage",
"value": {
"type": "string",
"value": "23% (1006 GB of 4400 GB)"
}
}
]
}
}

I need data in table format. Can you help me on this.
alt text

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults count =1 
| eval _raw = "
 {
   \"Name\": \"Test\",
   \"extensionData\": {
     \"entries\": [
       {
         \"key\": \"machinesTotal\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 7
         }
       },
       {
         \"key\": \"endpoint\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"vcenter.local\"
                                                                                             }
       },
       {
         \"key\": \"quotaAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"27% (6 of 22)\"
                                                                                             }
       },
       {
         \"key\": \"storageUsed\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 1006
         }
       },
       {
         \"key\": \"machinesAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"86% (6 of 7)\"
                                                                                             }
       },
       {
         \"key\": \"memoryAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"20% (72 GB of 352 GB)\"
                                                                                             }
       },
       {
         \"key\": \"computeResource\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"Data-Cluster\"
                                                                                             }
       },
       {
         \"key\": \"storageAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                             }
       },
       {
         \"key\": \"storageUsedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                             }
       }
     ]
   }
 }" 
| spath path=extensionData.entries{}.key output=key 
| spath path=extensionData.entries{}.value.value output=value 
| spath path=Name output=Name 
| eval key_value_combined=mvzip(key,value) 
| stats values(Name) as Name by key_value_combined 
| eval key_value= split(key_value_combined,",") 
| eval key=mvindex(key_value,0),value=mvindex(key_value,1) 
| chart values(value) as value over Name by key

or

| makeresults count =1 
| eval _raw = "
 {
   \"Name\": \"Test\",
   \"extensionData\": {
     \"entries\": [
       {
         \"key\": \"machinesTotal\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 7
         }
       },
       {
         \"key\": \"endpoint\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"vcenter.local\"
                                                                                                         }
       },
       {
         \"key\": \"quotaAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"27% (6 of 22)\"
                                                                                                         }
       },
       {
         \"key\": \"storageUsed\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 1006
         }
       },
       {
         \"key\": \"machinesAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"86% (6 of 7)\"
                                                                                                         }
       },
       {
         \"key\": \"memoryAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"20% (72 GB of 352 GB)\"
                                                                                                         }
       },
       {
         \"key\": \"computeResource\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"Data-Cluster\"
                                                                                                         }
       },
       {
         \"key\": \"storageAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                                         }
       },
       {
         \"key\": \"storageUsedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                                         }
       }
     ]
   }
 }" 
| spath path=extensionData.entries{}.key output=key 
| spath path=extensionData.entries{}.value.value output=value 
| spath path=Name output=Name 
| eval key_value_combined=mvzip(key,value) 
| stats values(Name) as Name by key_value_combined 
| eval key_value= split(key_value_combined,",") 
| eval key=mvindex(key_value,0),value=mvindex(key_value,1) 
| eval {key}=value 
| stats values(*) as * 
| fields - key value key_value key_value_combined

tauliang
Communicator

Something like this?

| makeresults  count =1
| eval _raw = "
{
  \"Name\": \"Test\",
  \"extensionData\": {
    \"entries\": [
      {
        \"key\": \"machinesTotal\",
        \"value\": {
          \"type\": \"integer\",
          \"value\": 7
        }
      },
      {
        \"key\": \"endpoint\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"vcenter.local\"
        }
      },
      {
        \"key\": \"quotaAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"27% (6 of 22)\"
        }
      },
      {
        \"key\": \"storageUsed\",
        \"value\": {
          \"type\": \"integer\",
          \"value\": 1006
        }
      },
      {
        \"key\": \"machinesAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"86% (6 of 7)\"
        }
      },
      {
        \"key\": \"memoryAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"20% (72 GB of 352 GB)\"
        }
      },
      {
        \"key\": \"computeResource\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"Data-Cluster\"
        }
      },
      {
        \"key\": \"storageAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"23% (1006 GB of 4400 GB)\"
        }
      },
      {
        \"key\": \"storageUsedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"23% (1006 GB of 4400 GB)\"
        }
      }
    ]
  }
}"

| spath
| rename extensionData.entries{}.key as key
| rename extensionData.entries{}.value.type as type
| rename extensionData.entries{}.value.value as value
| eval zipped=mvzip( key, mvzip( type, value ) )
| mvexpand zipped
| eval zipped=split( zipped, "," )
| eval key=mvindex( zipped, 0 )
| eval type=mvindex( zipped, 1 )
| eval value =mvindex( zipped, 2 )
| table key,value
| transpose
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...