Splunk Search

_json query problem

spisiakmi
Communicator

Hi, can anybody help me please?

I have _json indexed events in Splunk.

19.08.21 08:26:27,746

{ [-]
   nameS8.ManuelFail
   valuefalse

}

19.08.21 08:26:25,746

{ [-]
   nameS8.Pruefprogramm_PG
   valueS3_450

}

19.08.21 08:26:27,746

{ [-]
   nameS8.ManuelFail
   valuetrue

}

19.08.21 08:27:25,746

{ [-]
   nameS8.Pruefprogramm_PG
   valueS3_450

}

19.08.21 08:28:25,746

{ [-]
   nameS8.Pruefprogramm_PG
   valueS3_600

}

19.08.21 08:29:25,746

{ [-]
   nameS8.Pruefprogramm_PG
   valueS3_600

}

In the dashboard I choose specific time interval with the time pick up element. E.g. last 24 hours. I would like to have % number for each name: S8.Pruefprogramm_PG and its value, where name: S8.ManuelFail has value: true. It means % all name: S8.ManuelFail
value: true against all name: S8.ManuelFail
value: true/false. It is even possible? E.g. in this case I would like to have a table output:

S8.Pruefprogramm_PG S8.ManuelFail [%]

S3_450 50

Labels (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

@spisiakmi  Can you share the original _raw json? switch to raw mode in search UI.

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...