Hi, complete Splunk beginner here, so sorry it this is a stupid question. I'm trying to chart some data that I'm pulling from an MQTT broker. The Splunk MQTT Modular Input app is doing its thing a...
See more...
Hi, complete Splunk beginner here, so sorry it this is a stupid question. I'm trying to chart some data that I'm pulling from an MQTT broker. The Splunk MQTT Modular Input app is doing its thing and data is arriving every 5 minutes. Using the most basic query ( source="mqtt://MeteoMQTT" ) gives these results: Fri Jul 26 15:24:46 BST 2024 name=mqtt_msg_received event_id= topic=meteobridge msg={"meteoTemp":17.9,"meteoHumidity":64,"meteoRainlasthour":0,"meteoWindSpeed":6.04,"meteoWindDirection":"SW","meteolunarPercent":67.3} What I really want to do though is to break out the values from the most recent data poll into separate "elements" that can then be added to a dashboard. I tried using the spath command: source="mqtt://MeteoMQTT" | spath output=meteoTemp path=meteoTemp But that just returned the whole object again. So, how can i parse out the different values (meteoTemp, meteoHumidity, meteoRainlasthour, etc), so that i can add their most recent values as individual dashboard elements please? TIA.