Hi there! I am kinda new to Splunk so I apologize if my wording is off, but I am trying to collect metrics from a weirder phone system, and the way it presents data is like this: { "response": { ...
See more...
Hi there! I am kinda new to Splunk so I apologize if my wording is off, but I am trying to collect metrics from a weirder phone system, and the way it presents data is like this: { "response": { "method": "switchvox.callQueues.getCurrentStatus", "result": { "call_queue": { "extension": "***", "strategy": "ring_all", "queue_members": { "queue_member": [ { "paused_time": "15911", "completed_calls": "8", "paused_since": "", "talking_to_name": "", "login_type": "login", "order": "1", "login_time": "32963", "extension": "***", "max_talk_time": "661", "time_of_last_call": "2021-01-06 13:52:31", "paused": "0", "account_id": "***", "missed_calls": "14", "logged_in_status": "logged_off", "fullname": "***", "talking_to_number": "", "avg_talk_time": "443" }, Where it restates the variable name with each record. So far I have the rest api module pulling the data, and doing some light translation on it (it still looks like an array but it is at least identifying each extension). Is there a way to get Splunk to use the first portion of each response as a field name while tying it to the same record? EX: { "paused_time": "15911", "completed_calls": "8", "paused_since": "", "talking_to_name": "", "login_type": "login", "order": "1", "login_time": "32963", "extension": "***", "max_talk_time": "661", "time_of_last_call": "2021-01-06 13:52:31", "paused": "0", "account_id": "**1", "missed_calls": "14", "logged_in_status": "logged_off", "fullname": "***", "talking_to_number": "", "avg_talk_time": "443" }, getting converted to Account_ID login_time missed_calls paused_since avg_talk_time max_talk_time **1 32963 14 443 661 **2 32945 0 250 450