Splunk Search

How to put data in table format

chaitu1231
New Member

Name :Test
"extensionData": {
"entries": [
{
"key": "machinesTotal",
"value": {
"type": "integer",
"value": 7
}
},
{
"key": "endpoint",
"value": {
"type": "string",
"value": "vcenter.local"
}
},
{
"key": "quotaAllocatedPercentage",
"value": {
"type": "string",
"value": "27% (6 of 22)"
}
},
{
"key": "storageUsed",
"value": {
"type": "integer",
"value": 1006
}
},
{
"key": "machinesAllocatedPercentage",
"value": {
"type": "string",
"value": "86% (6 of 7)"
}
},
{
"key": "memoryAllocatedPercentage",
"value": {
"type": "string",
"value": "20% (72 GB of 352 GB)"
}
},
{
"key": "computeResource",
"value": {
"type": "string",
"value": "Data-Cluster"
}
},
{
"key": "storageAllocatedPercentage",
"value": {
"type": "string",
"value": "23% (1006 GB of 4400 GB)"
}
},
{
"key": "storageUsedPercentage",
"value": {
"type": "string",
"value": "23% (1006 GB of 4400 GB)"
}
}
]
}
}

I need data in table format. Can you help me on this.
alt text

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults count =1 
| eval _raw = "
 {
   \"Name\": \"Test\",
   \"extensionData\": {
     \"entries\": [
       {
         \"key\": \"machinesTotal\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 7
         }
       },
       {
         \"key\": \"endpoint\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"vcenter.local\"
                                                                                             }
       },
       {
         \"key\": \"quotaAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"27% (6 of 22)\"
                                                                                             }
       },
       {
         \"key\": \"storageUsed\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 1006
         }
       },
       {
         \"key\": \"machinesAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"86% (6 of 7)\"
                                                                                             }
       },
       {
         \"key\": \"memoryAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"20% (72 GB of 352 GB)\"
                                                                                             }
       },
       {
         \"key\": \"computeResource\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"Data-Cluster\"
                                                                                             }
       },
       {
         \"key\": \"storageAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                             }
       },
       {
         \"key\": \"storageUsedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                             }
       }
     ]
   }
 }" 
| spath path=extensionData.entries{}.key output=key 
| spath path=extensionData.entries{}.value.value output=value 
| spath path=Name output=Name 
| eval key_value_combined=mvzip(key,value) 
| stats values(Name) as Name by key_value_combined 
| eval key_value= split(key_value_combined,",") 
| eval key=mvindex(key_value,0),value=mvindex(key_value,1) 
| chart values(value) as value over Name by key

or

| makeresults count =1 
| eval _raw = "
 {
   \"Name\": \"Test\",
   \"extensionData\": {
     \"entries\": [
       {
         \"key\": \"machinesTotal\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 7
         }
       },
       {
         \"key\": \"endpoint\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"vcenter.local\"
                                                                                                         }
       },
       {
         \"key\": \"quotaAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"27% (6 of 22)\"
                                                                                                         }
       },
       {
         \"key\": \"storageUsed\",
         \"value\": {
           \"type\": \"integer\",
           \"value\": 1006
         }
       },
       {
         \"key\": \"machinesAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"86% (6 of 7)\"
                                                                                                         }
       },
       {
         \"key\": \"memoryAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"20% (72 GB of 352 GB)\"
                                                                                                         }
       },
       {
         \"key\": \"computeResource\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"Data-Cluster\"
                                                                                                         }
       },
       {
         \"key\": \"storageAllocatedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                                         }
       },
       {
         \"key\": \"storageUsedPercentage\",
         \"value\": {
           \"type\": \"string\",
           \"value\": \"23% (1006 GB of 4400 GB)\"
                                                                                                         }
       }
     ]
   }
 }" 
| spath path=extensionData.entries{}.key output=key 
| spath path=extensionData.entries{}.value.value output=value 
| spath path=Name output=Name 
| eval key_value_combined=mvzip(key,value) 
| stats values(Name) as Name by key_value_combined 
| eval key_value= split(key_value_combined,",") 
| eval key=mvindex(key_value,0),value=mvindex(key_value,1) 
| eval {key}=value 
| stats values(*) as * 
| fields - key value key_value key_value_combined

tauliang
Communicator

Something like this?

| makeresults  count =1
| eval _raw = "
{
  \"Name\": \"Test\",
  \"extensionData\": {
    \"entries\": [
      {
        \"key\": \"machinesTotal\",
        \"value\": {
          \"type\": \"integer\",
          \"value\": 7
        }
      },
      {
        \"key\": \"endpoint\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"vcenter.local\"
        }
      },
      {
        \"key\": \"quotaAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"27% (6 of 22)\"
        }
      },
      {
        \"key\": \"storageUsed\",
        \"value\": {
          \"type\": \"integer\",
          \"value\": 1006
        }
      },
      {
        \"key\": \"machinesAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"86% (6 of 7)\"
        }
      },
      {
        \"key\": \"memoryAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"20% (72 GB of 352 GB)\"
        }
      },
      {
        \"key\": \"computeResource\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"Data-Cluster\"
        }
      },
      {
        \"key\": \"storageAllocatedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"23% (1006 GB of 4400 GB)\"
        }
      },
      {
        \"key\": \"storageUsedPercentage\",
        \"value\": {
          \"type\": \"string\",
          \"value\": \"23% (1006 GB of 4400 GB)\"
        }
      }
    ]
  }
}"

| spath
| rename extensionData.entries{}.key as key
| rename extensionData.entries{}.value.type as type
| rename extensionData.entries{}.value.value as value
| eval zipped=mvzip( key, mvzip( type, value ) )
| mvexpand zipped
| eval zipped=split( zipped, "," )
| eval key=mvindex( zipped, 0 )
| eval type=mvindex( zipped, 1 )
| eval value =mvindex( zipped, 2 )
| table key,value
| transpose
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...