Splunk Search

Timeline visualization using attributes of an single event

Hung_Nguyen
Path Finder

In order to visual a data table with 4 columns: time, resource1, resource2, duration.  I know who to do this with data coming from different events.  However in my case, all the data is stored in a single performance metric splunk event. The event would look like the blob below where measureStart node contains the start time of these tasks, and the measure node contains the durations of these tasks

Splunk Event:


     measureStart: {
            "super_Task1: mini task1": 2021-11-12T02:50:05.430Z,
           "super_Task1: mini task2": 2021-11-12T02:50:06.430Z,
           "super_Task2: mini task1": 2021-11-12T02:50:07.430Z,
    },
    measures: {
           "super_Task1: mini task1": 50,
           "super_Task1: mini task2": 100,
           "super_Task2: mini task1": 80,
    }
}

I would like to produce a table that looks like this
time                                                             supertasks            tasks              duration
2021-11-12T02:50:05.430Z            super_Task1        point1                  50
2021-11-12T02:50:06.430Z            super_Task1        point2                 100
2021-11-12T02:50:07.430Z            super_Task2        point1                  80

thank you very much!

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="{ 
    \"measureStart\": {
        \"super_Task1: mini task1\": \"2021-11-12T02:50:05.430Z\",
        \"super_Task1: mini task2\": \"2021-11-12T02:50:06.430Z\",
        \"super_Task2: mini task1\": \"2021-11-12T02:50:07.430Z\"
    },
    \"measures\": {
        \"super_Task1: mini task1\": 50,
        \"super_Task1: mini task2\": 100,
        \"super_Task2: mini task1\": 80
    }
}"



| spath measureStart
| spath measures
| spath input=measureStart
| spath input=measures
| fields - _raw measureStart measures
| untable _time task values
| rex field=values max_match=0 "(?<values>\S+)"
| eval supertask=mvindex(split(task,":"),0)
| eval task=trim(mvindex(split(task,":"),1))
| eval _time=strptime(mvindex(values,0),"%Y-%m-%dT%H:%M:%S.%QZ")
| eval duration=mvindex(values,1)
| fields - values

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="{ 
    \"measureStart\": {
        \"super_Task1: mini task1\": \"2021-11-12T02:50:05.430Z\",
        \"super_Task1: mini task2\": \"2021-11-12T02:50:06.430Z\",
        \"super_Task2: mini task1\": \"2021-11-12T02:50:07.430Z\"
    },
    \"measures\": {
        \"super_Task1: mini task1\": 50,
        \"super_Task1: mini task2\": 100,
        \"super_Task2: mini task1\": 80
    }
}"



| spath measureStart
| spath measures
| spath input=measureStart
| spath input=measures
| fields - _raw measureStart measures
| untable _time task values
| rex field=values max_match=0 "(?<values>\S+)"
| eval supertask=mvindex(split(task,":"),0)
| eval task=trim(mvindex(split(task,":"),1))
| eval _time=strptime(mvindex(values,0),"%Y-%m-%dT%H:%M:%S.%QZ")
| eval duration=mvindex(values,1)
| fields - values
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...