Splunk Search

json spath variable and timeseries data output i need

sri777
New Member

I am newbie to splunk

Data is json output
{"fdc": {"available": 1248, "unavailable": 0, "undefined": 0}, "mwdc": {"available": 6459, "unavailable": 0, "undefined": 17}, "dev": {"available": 277, "unavailable": 0, "undefined": 1}, "ct2": {"available": 1352, "unavailable": 0, "undefined": 0}, "ast": {"available": 0, "unavailable": 0, "undefined": 0}, "Timestamp": "Friday, 07. July 2017 12:20PM", "mwdc2": {"available": 1616, "unavailable": 0, "undefined": 0}, "uat": {"available": 219, "unavailable": 0, "undefined": 0}, "swdc": {"available": 3672, "unavailable": 0, "undefined": 3}, "gtdc": {"available": 8532, "unavailable": 1, "undefined": 4}, "gtdc2": {"available": 5403, "unavailable": 0, "undefined": 12}, "rdc": {"available": 2331, "unavailable": 0, "undefined": 0}}

i need a time series chart for each of these location like FDC three line chart available / unavailable / undefined.

index=some_index sourcetype="json:status_data"|spath ast.available |spath ast.unavailable |spath ast.undefined
i get for ast the fields but how to make for each site and their respective line graph

0 Karma

krishnarajb2304
Explorer

try something like this,

index=some_index sourcetype="json:status_data"|spath  | fields Timestamp, fdc.available, fdc.unavailable, fdc.undefined

you will have the extracted fields like,

field

Timestamp
ast.available
ast.unavailable
ast.undefined
ct2.available
ct2.unavailable
ct2.undefined
dev.available
dev.unavailable
dev.undefined
fdc.available
fdc.unavailable
fdc.undefined
gtdc.available
gtdc.unavailable
gtdc.undefined
gtdc2.available
gtdc2.unavailable
gtdc2.undefined
mwdc.available
mwdc.unavailable
mwdc.undefined
mwdc2.available
mwdc2.unavailable
mwdc2.undefined
rdc.available
rdc.unavailable
rdc.undefined
swdc.available
swdc.unavailable
swdc.undefined
uat.available
uat.unavailable
uat.undefined
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...