Splunk Search

how can i set a variables to each jsonarray object?

ktaeil
Engager

_Raw json format is below
{
"test-03": {
"field1": 97869,
"field2": 179771,
"field3": "test-03",
"traffics": 1070140210
},
"test-08": {
"field1": 53094,
"field2": 103840,
"field3": "test-08",
"traffics": 998807234
},
"test-09": {
"field1": 145655,
"field2": 250518,
"field3": "test-09",
"traffics": 2212423288
},
"test-10": {
"field1": 83663,
"field2": 151029,
"field3": "test-10",
"traffics": 762554139
},
"k": 63314
}

when i use  timechart avg(test*.traffics) , it works 

 but number was so huge, so i tried to change |eval test*.traffics=round(test*.traffics/1024,2) but it didnt work.

can anybody help it please

Labels (2)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

You cannot use wildcard group in eval.  Use foreach to iterate.

| foreach test-*.traffics
    [eval <<FIELD>> = round('<<FIELD>>' / 1024, 2)]

View solution in original post

Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

You cannot use wildcard group in eval.  Use foreach to iterate.

| foreach test-*.traffics
    [eval <<FIELD>> = round('<<FIELD>>' / 1024, 2)]
Tags (1)
0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...