Splunk Search
Highlighted

How to put data in table format

New Member

Name :Test
"extensionData": {
"entries": [
{
"key": "machinesTotal",
"value": {
"type": "integer",
"value": 7
}
},
{
"key": "endpoint",
"value": {
"type": "string",
"value": "vcenter.local"
}
},
{
"key": "quotaAllocatedPercentage",
"value": {
"type": "string",
"value": "27% (6 of 22)"
}
},
{
"key": "storageUsed",
"value": {
"type": "integer",
"value": 1006
}
},
{
"key": "machinesAllocatedPercentage",
"value": {
"type": "string",
"value": "86% (6 of 7)"
}
},
{
"key": "memoryAllocatedPercentage",
"value": {
"type": "string",
"value": "20% (72 GB of 352 GB)"
}
},
{
"key": "computeResource",
"value": {
"type": "string",
"value": "Data-Cluster"
}
},
{
"key": "storageAllocatedPercentage",
"value": {
"type": "string",
"value": "23% (1006 GB of 4400 GB)"
}
},
{
"key": "storageUsedPercentage",
"value": {
"type": "string",
"value": "23% (1006 GB of 4400 GB)"
}
}
]
}
}

I need data in table format. Can you help me on this.
alt text

0 Karma
Highlighted

Re: How to put data in table format

Communicator

Something like this?

| makeresults  count =1
| eval _raw = "
{
  \"Name\": \"Test\",
  \"extensionData\": {
    \"entries\": [
      {
        \"key\": \"machinesTotal\",
        \"value\": {
          \"type\": \"integer\",
          \"value\": 7
        }
      },
      {
        \"key\": \"endpoint\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"vcenter.local\"
        }
      },
      {
        \"key\": \"quotaAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"27% (6 of 22)\"
        }
      },
      {
        \"key\": \"storageUsed\",
        \"value\": {
          \"type\": \"integer\",
          \"value\": 1006
        }
      },
      {
        \"key\": \"machinesAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"86% (6 of 7)\"
        }
      },
      {
        \"key\": \"memoryAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"20% (72 GB of 352 GB)\"
        }
      },
      {
        \"key\": \"computeResource\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"Data-Cluster\"
        }
      },
      {
        \"key\": \"storageAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"23% (1006 GB of 4400 GB)\"
        }
      },
      {
        \"key\": \"storageUsedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"23% (1006 GB of 4400 GB)\"
        }
      }
    ]
  }
}"

| spath
| rename extensionData.entries{}.key as key
| rename extensionData.entries{}.value.type as type
| rename extensionData.entries{}.value.value as value
| eval zipped=mvzip( key, mvzip( type, value ) )
| mvexpand zipped
| eval zipped=split( zipped, "," )
| eval key=mvindex( zipped, 0 )
| eval type=mvindex( zipped, 1 )
| eval value =mvindex( zipped, 2 )
| table key,value
| transpose
Highlighted

Re: How to put data in table format

Champion

Hi

Try this

| makeresults count =1 
| eval _raw = "
 {
   \"Name\": \"Test\",
   \"extensionData\": {
     \"entries\": [
       {
         \"key\": \"machinesTotal\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 7
         }
       },
       {
         \"key\": \"endpoint\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"vcenter.local\"
                                                                                             }
       },
       {
         \"key\": \"quotaAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"27% (6 of 22)\"
                                                                                             }
       },
       {
         \"key\": \"storageUsed\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 1006
         }
       },
       {
         \"key\": \"machinesAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"86% (6 of 7)\"
                                                                                             }
       },
       {
         \"key\": \"memoryAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"20% (72 GB of 352 GB)\"
                                                                                             }
       },
       {
         \"key\": \"computeResource\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"Data-Cluster\"
                                                                                             }
       },
       {
         \"key\": \"storageAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                             }
       },
       {
         \"key\": \"storageUsedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                             }
       }
     ]
   }
 }" 
| spath path=extensionData.entries{}.key output=key 
| spath path=extensionData.entries{}.value.value output=value 
| spath path=Name output=Name 
| eval key_value_combined=mvzip(key,value) 
| stats values(Name) as Name by key_value_combined 
| eval key_value= split(key_value_combined,",") 
| eval key=mvindex(key_value,0),value=mvindex(key_value,1) 
| chart values(value) as value over Name by key

or

| makeresults count =1 
| eval _raw = "
 {
   \"Name\": \"Test\",
   \"extensionData\": {
     \"entries\": [
       {
         \"key\": \"machinesTotal\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 7
         }
       },
       {
         \"key\": \"endpoint\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"vcenter.local\"
                                                                                                         }
       },
       {
         \"key\": \"quotaAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"27% (6 of 22)\"
                                                                                                         }
       },
       {
         \"key\": \"storageUsed\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 1006
         }
       },
       {
         \"key\": \"machinesAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"86% (6 of 7)\"
                                                                                                         }
       },
       {
         \"key\": \"memoryAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"20% (72 GB of 352 GB)\"
                                                                                                         }
       },
       {
         \"key\": \"computeResource\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"Data-Cluster\"
                                                                                                         }
       },
       {
         \"key\": \"storageAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                                         }
       },
       {
         \"key\": \"storageUsedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                                         }
       }
     ]
   }
 }" 
| spath path=extensionData.entries{}.key output=key 
| spath path=extensionData.entries{}.value.value output=value 
| spath path=Name output=Name 
| eval key_value_combined=mvzip(key,value) 
| stats values(Name) as Name by key_value_combined 
| eval key_value= split(key_value_combined,",") 
| eval key=mvindex(key_value,0),value=mvindex(key_value,1) 
| eval {key}=value 
| stats values(*) as * 
| fields - key value key_value key_value_combined
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.