Splunk Search

What is the best solution to table list of keys which can be eventually used for input dropdown in dashboard?

kirangurram
Explorer

Hello Folks ,

I have json data in below format. I am looking for a best solution to table list of Keys which can be eventually used for input dropdown in dashboard.

output of the table content needs to be like below. your help is much appreciated.

bzk.f1

bzk.f4

bzk.f8




{ [-]
   bzk: { [-]
     f1: ABC
     f4ABC
     f8: ABC

}

}

Labels (2)
Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

So, your data already contain fields named bzk.f1, bzk.f4, etc.  The following should give you a single-field table:

| foreach bzk.*
    [eval inputfield = mvappend(inputfield, "<<FIELD>>")]
| table inputfield

Alternatively, you can use spath together with the newer JSON functions

| spath input=data path=bzk
| eval inputfield = json_array_to_mv(json_keys(bzk))
| eval inputfield = mvmap(inputfield, "bzk." . inputfield)
| table inputfield

  

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| spath
| fields - _time _raw
| transpose column_name=name
| fields name
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...