Hi,
I have an application that logs in json format using arrays. I want to do stats function on the elements in the array but cannot figure out how.
Log file:
{ "timestamp": "2013-01-04 09:15:54","Data":{"sample": 1, "objects" : [ { "id" : "a", "value":55 }, { "id" : "b", "value":77 }, { "id" : "c", "value":99 } ] } }
{ "timestamp": "2013-01-04 09:17:34","Data":{"sample": 2, "objects" : [ { "id" : "a", "value":88 }, { "id" : "b", "value":717 }, { "id" : "c", "value":6 } ] } }
{ "timestamp": "2013-01-04 09:19:04","Data":{"sample": 3, "objects" : [ { "id" : "a", "value":456 }, { "id" : "b", "value":77 }, { "id" : "c", "value":1 } ] } }
The query using the indexes found by splunk:
sourcetype="testtest" | stats max(Data.objects{}.value) BY Data.objects{}.id
results in 717 for all ids when 456,717,99 is expected
What I would like to achieve is creat a chart with 'sample' ox x-axis and 'value' for each 'id' on y-axis
Hope anyone can give me a hint. Thanks
... View more
