Plotting bar chart X axis are JSON keys and Y axis are length of JSON values

[oKeNiDJE]

Hi

I have the following JSON object.

I would like to be able to ultimately create a bar chart with the following:

X-Axis: Animal type ie dog, cat, chicken.....

Y-Axis: The length of animal's array, this example, dog=2 cat=3 chicken=1

{
	"data": {
		"animals": {
			"dog": [{"name": "rex", "id": 1}, {"name": "tom", "id": 2}],
			"cat": [{"name": "rex", "id": 3}, {"name": "tom", "id": 4}, {"name": "sam", "id": 5}],
			"chicken": [{"name": "rex", "id": 6}]
		}
	}
}

I'm new to Splunk so apologies but I'm not sure where to even begin

Thanks in advance for any help

[oKeNiDJE]

This has been super helpful @kamlesh_vaghela ! Thank you so much

Say if you had a JSON object however and didn't want to convert it to a string and use rex, would that be possible?

[kamlesh_vaghela]

@oKeNiDJE 

That you need to POC and check 😅.  Coz, Splunk ingest characters / text format and if you ingest Json object then Splunk might be ingest represented value of that object and that might be invalid data for as. 

Splunk need valid json string for auto discovery of fields.

So here I suggest keep it in converted string format and use rex for our requirements . 😊

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[oKeNiDJE]

Thanks @kamlesh_vaghela . That would work yes,  however, I need the search query to be dynamic because I don't know the keys ahead of time. 

Any idea on how to do this?

[kamlesh_vaghela]

@oKeNiDJE 

I have updated my answer. Can you please check it?

KV

[kamlesh_vaghela]

@oKeNiDJE 

Can you please try this?

YOUR_SEARCH 
| rex field=_raw "\"(?<animal>\w+)\":\s\[(?<arr>[^\]]*])" max_match=0
| eval t=mvzip(animal,arr,"|")
|stats count by t
| eval animal=mvindex(split(t,"|"),0),arr="[".mvindex(split(t,"|"),1) |fields - t, count
| rex field=arr "\"id\":\s(?<ids>\d)" max_match=0|eval count=mvcount(ids) 
| table animal count

My Sample Search :

| makeresults | eval _raw="{\"data\": {\"animals\": {\"dog\": [{\"name\": \"rex\", \"id\": 1}, {\"name\": \"tom\", \"id\": 2}],\"cat\": [{\"name\": \"rex\", \"id\": 3}, {\"name\": \"tom\", \"id\": 4}, {\"name\": \"sam\", \"id\": 5}],\"chicken\": [{\"name\": \"rex\", \"id\": 6}]}}}" 
| rex field=_raw "\"(?<animal>\w+)\":\s\[(?<arr>[^\]]*])" max_match=0
| eval t=mvzip(animal,arr,"|")
|stats count by t
| eval animal=mvindex(split(t,"|"),0),arr="[".mvindex(split(t,"|"),1) |fields - t, count
| rex field=arr "\"id\":\s(?<ids>\d)" max_match=0|eval count=mvcount(ids) 
| table animal count

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.