Splunk Search

how can i set a variables to each jsonarray object?

ktaeil
Engager

_Raw json format is below
{
"test-03": {
"field1": 97869,
"field2": 179771,
"field3": "test-03",
"traffics": 1070140210
},
"test-08": {
"field1": 53094,
"field2": 103840,
"field3": "test-08",
"traffics": 998807234
},
"test-09": {
"field1": 145655,
"field2": 250518,
"field3": "test-09",
"traffics": 2212423288
},
"test-10": {
"field1": 83663,
"field2": 151029,
"field3": "test-10",
"traffics": 762554139
},
"k": 63314
}

when i use  timechart avg(test*.traffics) , it works 

 but number was so huge, so i tried to change |eval test*.traffics=round(test*.traffics/1024,2) but it didnt work.

can anybody help it please

Labels (2)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

You cannot use wildcard group in eval.  Use foreach to iterate.

| foreach test-*.traffics
    [eval <<FIELD>> = round('<<FIELD>>' / 1024, 2)]

View solution in original post

Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

You cannot use wildcard group in eval.  Use foreach to iterate.

| foreach test-*.traffics
    [eval <<FIELD>> = round('<<FIELD>>' / 1024, 2)]
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...