×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
ktaeil
Engager
Member since: ‎10-19-2023
‎10-23-2023
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎10-19-2023
Activity Feed
View All

which is more better structure when use json array

by in Splunk Search
‎10-19-2023 05:42 PM
‎10-19-2023 05:42 PM
when i made a log for HEC with json array, im not sure what is more better way to use spl. can someone advise me please? way 1.  {host: 'test' lists : [{                    id: ' list1'                    ip: '192.168.0.1'                    device: 'laptop'                    value: 123                    },                  {                    id: ' list2'                    ip: '192.168.0.2'                    device: 'phone'                    value: 1223                    },                  {                    id: ' list3'                    ip: '192.168.0.3'                    device: 'desktop'                    value: 99                    }, ]}   way2. {host: 'test' list1 :{                    id: ' list1'                    ip: '192.168.0.1'                    device: 'laptop'                    value: 123              } list2 : {                    id: ' list2'                    ip: '192.168.0.2'                    device: 'phone'                    value: 1223                    }, list3:   {                    id: ' list3'                    ip: '192.168.0.3'                    device: 'desktop'                    value: 99                    }, ]}   ... View more
Labels

how can i set a variables to each jsonarray object...

by in Splunk Search
‎10-19-2023 05:34 PM
‎10-19-2023 05:34 PM
_Raw json format is below { "test-03": { "field1": 97869, "field2": 179771, "field3": "test-03", "traffics": 1070140210 }, "test-08": { "field1": 53094, "field2": 103840, "field3": "test-08", "traffics": 998807234 }, "test-09": { "field1": 145655, "field2": 250518, "field3": "test-09", "traffics": 2212423288 }, "test-10": { "field1": 83663, "field2": 151029, "field3": "test-10", "traffics": 762554139 }, "k": 63314 } when i use  timechart avg(test*.traffics) , it works   but number was so huge, so i tried to change |eval test*.traffics=round(test*.traffics/1024,2) but it didnt work. can anybody help it please ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎10-23-2023 06:57 PM