Splunk Search

JSON Field Extraction and Charting

sarnathkj
Explorer

I have a sample JSON just like this.

{"Domain":"DotComMobile","Metrics":"city","Brooklyn":782,"Bronx":450,"New York":411,"Philadelphia":287,"Chicago":254,"Washington":210,"Silver Spring":176,"Houston":148,"Los Angeles":140,"Boston":133}

I want to chart the values corresponding to cities in a pie chart similar to the picture attached. How would I accomplish this?

spath extracts the JSON as individual key value pairs but not able to move further from there to creating pier chart of the cities in the JSON.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Here is one way to get the pie chart to work. It may not be the best, but it will at least get you started. It is a run-anywhere search that you can just paste into the search bar and it will show you the results of the data that you have provided:

| makeresults
| eval data="{\"Domain\":\"DotComMobile\",\"Metrics\":\"city\",\"Brooklyn\":782,\"Bronx\":450,\"New York\":411,\"Philadelphia\":287,\"Chicago\":254,\"Washington\":210,\"Silver Spring\":176,\"Houston\":148,\"Los Angeles\":140,\"Boston\":133}"
| spath input=data
| fields - data, Domain, _time, Metrics
| fieldsummary
| fields field max
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Navigating the show floor at .conf26 isn't just about keynotes and technical breakout sessions; it's also ...

Join the Final Session of the Data Management & Federation Bootcamp Series

Over the past three sessions of the Data Management & Federation Bootcamp Series, we've explored how to build ...

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...