Based on (https://answers.splunk.com/answers/709936/get-value-from-nested-json.html#answer-709944) I came up with a query:
index=dcos sourcetype=dcos:node:metrics
| rename datapoints{}.name as name, datapoints{}.value as value
| eval x=mvzip(name,value)
| mvexpand x
| eval x=split(x,",")
| eval name=mvindex(x,0)
| eval value=mvindex(x,1)
| table _time, name, value, host
| sort - _time
| search name=system.uptime
What I expected was a list with the system.uptime every minute for all 3 hosts, however it is not consistent and sometimes I only get the value for 1 host for a specific minute (see screenshot).
I checked to see if the data was onboarded allright and has the value I run my filter on (| search name=system.uptime) and all data has the value and is onboarded correct every minute.
When I run
index=dcos sourcetype=dcos:node:metrics
| spath datapoints{} output=datapoint
| mvexpand datapoint
| eval _raw=datapoint
| kv
| search name="system.uptime"
| table name value _time host
| sort - _time
I get the expected results ( I cant show it this website only allows 2 images) :S:
... View more