Splunk Search

JSON Field Extraction and Charting

sarnathkj
Explorer

I have a sample JSON just like this.

{"Domain":"DotComMobile","Metrics":"city","Brooklyn":782,"Bronx":450,"New York":411,"Philadelphia":287,"Chicago":254,"Washington":210,"Silver Spring":176,"Houston":148,"Los Angeles":140,"Boston":133}

I want to chart the values corresponding to cities in a pie chart similar to the picture attached. How would I accomplish this?

spath extracts the JSON as individual key value pairs but not able to move further from there to creating pier chart of the cities in the JSON.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Here is one way to get the pie chart to work. It may not be the best, but it will at least get you started. It is a run-anywhere search that you can just paste into the search bar and it will show you the results of the data that you have provided:

| makeresults
| eval data="{\"Domain\":\"DotComMobile\",\"Metrics\":\"city\",\"Brooklyn\":782,\"Bronx\":450,\"New York\":411,\"Philadelphia\":287,\"Chicago\":254,\"Washington\":210,\"Silver Spring\":176,\"Houston\":148,\"Los Angeles\":140,\"Boston\":133}"
| spath input=data
| fields - data, Domain, _time, Metrics
| fieldsummary
| fields field max
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform

Unlocking Data-In-Place Search Across Splunk and Snowflake  Enterprise data is increasingly distributed across ...

Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)

If you’ve spent any time in the Splunk Community Slack, you’ve likely seen our resident Splunk Trust ...

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Navigating the show floor at .conf26 isn't just about keynotes and technical breakout sessions; it's also ...