Splunk Search

how to extract the data from json to a table show

brightgong
New Member

i'm trying to extract data from json and show into my dashboard but failed

 

 

{
  "timestamp":"2021-04-22T09:14:38.727Z",
  "message":"Metrics: key1=false, [SystemMetricsBean] key2=key2val, [MetricAttributes] sumCountViaMetricsAnnotation=2, failureCount=0, sumDuration=46, minDuration=22, maxDuration=24, sumCountViaCacheAnnotation=2, numWithoutCache=2, numDisableCache=2",
  "version":"1.1.0"
}

 

 

i'd like to  extract failureCount and other statistic data then display in my dashboard

 

here is my search but not work:

 

 

base search 
| spath path=message,output=metrics
| stats count(sumDuration) as duration, count(failureCount) as fail

 

 

 

can u help to guide me? also i try other cmd like extract, eval, rex but also not got the result

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You are almost there - after the spath, copy the message field to _raw and run extract. The stats might be better as sums rather than counts, but it depends what it is that you are trying to get

| makeresults 
| eval _raw="{
  \"timestamp\":\"2021-04-22T09:14:38.727Z\",
  \"message\":\"Metrics: key1=false, [SystemMetricsBean] key2=key2val, [MetricAttributes] sumCountViaMetricsAnnotation=2, failureCount=0, sumDuration=46, minDuration=22, maxDuration=24, sumCountViaCacheAnnotation=2, numWithoutCache=2, numDisableCache=2\",
  \"version\":\"1.1.0\"
}"


| spath path=message,output=metrics
| eval _raw=metrics
| extract 
| stats sum(sumDuration) as duration, sum(failureCount) as fail
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!