json spath variable and timeseries data output i need

[sri777]

I am newbie to splunk

Data is json output
{"fdc": {"available": 1248, "unavailable": 0, "undefined": 0}, "mwdc": {"available": 6459, "unavailable": 0, "undefined": 17}, "dev": {"available": 277, "unavailable": 0, "undefined": 1}, "ct2": {"available": 1352, "unavailable": 0, "undefined": 0}, "ast": {"available": 0, "unavailable": 0, "undefined": 0}, "Timestamp": "Friday, 07. July 2017 12:20PM", "mwdc2": {"available": 1616, "unavailable": 0, "undefined": 0}, "uat": {"available": 219, "unavailable": 0, "undefined": 0}, "swdc": {"available": 3672, "unavailable": 0, "undefined": 3}, "gtdc": {"available": 8532, "unavailable": 1, "undefined": 4}, "gtdc2": {"available": 5403, "unavailable": 0, "undefined": 12}, "rdc": {"available": 2331, "unavailable": 0, "undefined": 0}}

i need a time series chart for each of these location like FDC three line chart available / unavailable / undefined.

index=some_index sourcetype="json:status_data"|spath ast.available |spath ast.unavailable |spath ast.undefined
i get for ast the fields but how to make for each site and their respective line graph

[krishnarajb2304]

try something like this,

index=some_index sourcetype="json:status_data"|spath  | fields Timestamp, fdc.available, fdc.unavailable, fdc.undefined

you will have the extracted fields like,

field

Timestamp
ast.available
ast.unavailable
ast.undefined
ct2.available
ct2.unavailable
ct2.undefined
dev.available
dev.unavailable
dev.undefined
fdc.available
fdc.unavailable
fdc.undefined
gtdc.available
gtdc.unavailable
gtdc.undefined
gtdc2.available
gtdc2.unavailable
gtdc2.undefined
mwdc.available
mwdc.unavailable
mwdc.undefined
mwdc2.available
mwdc2.unavailable
mwdc2.undefined
rdc.available
rdc.unavailable
rdc.undefined
swdc.available
swdc.unavailable
swdc.undefined
uat.available
uat.unavailable
uat.undefined