Hi experts, I am trying to create a dashboard from my data, which is logged in JSON format. However, I am stuck with getting sub-elements from the JSON as lines in my chart. Here is a sample log: { [-] DataThroughput: { [-] Updates per second: 576.0666666666667 Incoming Requests per second: 388.7 Processed Requests per second: 382.35 } DeploymentId: c84e3e1fe4f74408876bea1a9f6c60e1 LogLevel: Info LogTime: 2015-05-05T14:51:37.5168234+00:00 } I get one of these every minute into splunk. My ultimate goal is to have a timechart over the data throughput of my system, i.e.: X-Axis: The time (say over the last 1h) Y-Axis: The average throughput per second In this example, the timechart would have three lines (one for Updates / s, one for Incoming Requests / s and one for Processed Requests / s). Now I know how to do this for this static case, but in my real world scenario, the number of children under the node "DataThroughput" and their names is unknown and changes frequently. Is there a clever way to extract all children of the "DataThroughput" node in the JSON data and build a line in a timechart for each of them without specifying them directly? Thanks a lot, Christian ... View more

Hi experts, I recently came across the Web Framework Toolkit (version 1.1). (http://dev.splunk.com/webframework) So far, I have been using Splunk plain without apps, but I find the "Sunburst" Chart from the Web Framework Toolkit very helpful in one of my dashboards. Somehow I do not see at all from the documentation, how to integrate any of the charts / views in my dashboard. Is there a simple way of getting one of my searches to use the Sunburst chart? Thanks a lot, Christian ... View more

Hi experts, I am trying to find a way of extracting information out of a search result and combining this information with another row. It's pretty hard to explain, so let me show you what I mean: Search: index=idx LogType="Locations" Result: _time | Latitude |Longitude 13:27:00 | 52.111 | 17.111 13:30:00 | 52.222 | 17.222 13:33:00 | 52.333 | 17.333 13:36:00 | 52.444 | 17.444 This is the basic search I got. Now I would like to calculate the distance between each of the result rows. I found a plugin called haversine (https://splunkbase.splunk.com/app/936/#/overview) which calculates the distance between two geo locations, so that is not really the problem, but what I'm really struggling with is to combine two rows of this search. Ultimately, in the above example it should calculate three distances, dist(52.444, 17.444 -> 52.333, 17.333), dist(52.333, 17.333 -> 52.222, 17.222) and dist(52.222, 17.222 -> 52.111, 17.111). So the final result could look like this: _time | Distance 13:36:00 | 5000 13:33:00 | 4800 13:30:00 | 4600 Does anyone have an idea how something like this would be possible? Thanks a lot, Christian ... View more