Splunk Search

Shelly Energy Monitor EM3 access individual Values in MVFields

EnricoP
Engager

Hi,

im splunking a shelly EM3 Powermeter and get MV Values of the JSON status Rest API

http://192.168.1.2/status  which works fine but im getting the Power, Current etc for 3 Phases as Multivalue Fields .. 

how do i access or separate those individual Phases out of the MVFields ?

EnricoP_0-1630859752573.png

EnricoP_1-1630859913148.png

Like to have simple fields PowerL1=-76.85  PowerL2=635.06 PowerL3=-16.91

 or would it be better to fix that index time ? 

Thanks

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval PowerL1=mvindex('emeters{}.power',0)
| eval PowerL2=mvindex('emeters{}.power',1)
| eval PowerL3=mvindex('emeters{}.power',2)

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval PowerL1=mvindex('emeters{}.power',0)
| eval PowerL2=mvindex('emeters{}.power',1)
| eval PowerL3=mvindex('emeters{}.power',2)
0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...