About weiquanswq

weiquanswq · ‎10-12-2016

I am trying to extract both ArrivingTiming for both "nextBus" and " SubsequentBus". then add them below one another. Hope this is clearer. eg. name arrivalTime 123 2016-10-11T10:00:00 <- Next Bus ----------------+---------------------------------------------------- 456 | 2016-10-11T10:05:00 <- Next Bus ----------------+---------------------------------------------------- 123 | 2016-10-11T10:07:00 <- Subsequent Bus ----------------+---------------------------------------------------- 456 | 2016-10-11T10:12:00 <- Subsequent Bus ----------------+----------------------------------------------------

weiquanswq · ‎10-12-2016

I able to achieve the results I want using spath and extract according to the index. My code is as follows: ... | spath path=features{}.geometry.coordinates{}{0} output=a | spath path=features{}.geometry.coordinates{}{1} output=b | table a b | eval x=mvzip(a,b)| mvexpand x Hope this will be useful. 🙂

weiquanswq · ‎10-10-2016

Sundareshr, I am trying to combine both arr and est_arr columns into single column. eg. name | type | arrivalTime 123 | aa | 2016-10-11T10:00:00 <- Next Bus 456 | aa | 2016-10-11T10:05:00 123 | aa | 2016-10-11T10:07:00 <- Subsequent Bus

weiquanswq · ‎10-06-2016

Hi !! I am new to Splunk and trying to extract the array coordinates from Json. {"type":"Feature","geometry":{"type":"MultiPoint","coordinates":[[103.62107,1.27478],[103.622,1.29625], ……., [103.6224,1.28207]]}} Is anyone able to help me out here? Thanks

weiquanswq · ‎10-05-2016

Thanks sundareshr.

weiquanswq · ‎10-05-2016

HI!!! I am trying to combine two JsonArray (Nextbus & SubsequentBus) to a single column. I managed to extract both JsonArray but unable to append. This is how my data looks like this : Services: [ [-] { [-] NextBus: { [+] } Operator: xxx ServiceNo: 000 SubsequentBus: { [+] } } { [+] } { [+] } { [+] } ] This is my search query : ... | spath path=Services{} | rename Services{}.ServiceNo AS name , Services{}.Operator AS type, Services{}.NextBus{}.ArrivingTime As ar, Services{}.SubsequentBus{}.ArrivingTime As est_arr | eval x=mvzip(name,mvzip(type,arr) ) | mvexpand x | eval y=mvzip(name,mvzip(type,est_arr)) | mvexpand y Hope to get advice. Thanks in advance! 🙂

weiquanswq · ‎10-04-2016

ChrisG, I have modified the search to as such | table id, first, second | stats values(first) as firstVal values(second) as secondVal by id But it is still affected by firstVal

weiquanswq · ‎10-04-2016

Hi !! I am new to Splunk and trying to create a single value visualization with 2 values. ( ... | table first, second ) The "first" value determines the value to be displayed. The "second" value determines the color. Currently, I am able to display the "first" value but the color is affected by the "first" value. Is there any suggestion? Thanks in advance 🙂

Posts	8
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎10-04-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to extract the nested array coordinates from J...

How to combine two JsonArray into a single column?

How to modify my single value visualization?

Re: How to combine two JsonArray into a single col...

Re: How to extract the nested array coordinates fr...

Re: How to combine two JsonArray into a single col...

How to extract the nested array coordinates from J...

Re: How to modify my single value visualization?

How to combine two JsonArray into a single column?

Re: How to modify my single value visualization?

How to modify my single value visualization?

Join the Conversation