Hi
Try this
| makeresults count =1
| eval _raw = "
{
\"Name\": \"Test\",
\"extensionData\": {
\"entries\": [
{
\"key\": \"machinesTotal\",
\"value\": {
\"type\": \"integer\",
\"value\": 7
}
},
{
\"key\": \"endpoint\",
\"value\": {
\"type\": \"string\",
\"value\": \"vcenter.local\"
}
},
{
\"key\": \"quotaAllocatedPercentage\",
\"value\": {
\"type\": \"string\",
\"value\": \"27% (6 of 22)\"
}
},
{
\"key\": \"storageUsed\",
\"value\": {
\"type\": \"integer\",
\"value\": 1006
}
},
{
\"key\": \"machinesAllocatedPercentage\",
\"value\": {
\"type\": \"string\",
\"value\": \"86% (6 of 7)\"
}
},
{
\"key\": \"memoryAllocatedPercentage\",
\"value\": {
\"type\": \"string\",
\"value\": \"20% (72 GB of 352 GB)\"
}
},
{
\"key\": \"computeResource\",
\"value\": {
\"type\": \"string\",
\"value\": \"Data-Cluster\"
}
},
{
\"key\": \"storageAllocatedPercentage\",
\"value\": {
\"type\": \"string\",
\"value\": \"23% (1006 GB of 4400 GB)\"
}
},
{
\"key\": \"storageUsedPercentage\",
\"value\": {
\"type\": \"string\",
\"value\": \"23% (1006 GB of 4400 GB)\"
}
}
]
}
}"
| spath path=extensionData.entries{}.key output=key
| spath path=extensionData.entries{}.value.value output=value
| spath path=Name output=Name
| eval key_value_combined=mvzip(key,value)
| stats values(Name) as Name by key_value_combined
| eval key_value= split(key_value_combined,",")
| eval key=mvindex(key_value,0),value=mvindex(key_value,1)
| chart values(value) as value over Name by key
or
| makeresults count =1
| eval _raw = "
{
\"Name\": \"Test\",
\"extensionData\": {
\"entries\": [
{
\"key\": \"machinesTotal\",
\"value\": {
\"type\": \"integer\",
\"value\": 7
}
},
{
\"key\": \"endpoint\",
\"value\": {
\"type\": \"string\",
\"value\": \"vcenter.local\"
}
},
{
\"key\": \"quotaAllocatedPercentage\",
\"value\": {
\"type\": \"string\",
\"value\": \"27% (6 of 22)\"
}
},
{
\"key\": \"storageUsed\",
\"value\": {
\"type\": \"integer\",
\"value\": 1006
}
},
{
\"key\": \"machinesAllocatedPercentage\",
\"value\": {
\"type\": \"string\",
\"value\": \"86% (6 of 7)\"
}
},
{
\"key\": \"memoryAllocatedPercentage\",
\"value\": {
\"type\": \"string\",
\"value\": \"20% (72 GB of 352 GB)\"
}
},
{
\"key\": \"computeResource\",
\"value\": {
\"type\": \"string\",
\"value\": \"Data-Cluster\"
}
},
{
\"key\": \"storageAllocatedPercentage\",
\"value\": {
\"type\": \"string\",
\"value\": \"23% (1006 GB of 4400 GB)\"
}
},
{
\"key\": \"storageUsedPercentage\",
\"value\": {
\"type\": \"string\",
\"value\": \"23% (1006 GB of 4400 GB)\"
}
}
]
}
}"
| spath path=extensionData.entries{}.key output=key
| spath path=extensionData.entries{}.value.value output=value
| spath path=Name output=Name
| eval key_value_combined=mvzip(key,value)
| stats values(Name) as Name by key_value_combined
| eval key_value= split(key_value_combined,",")
| eval key=mvindex(key_value,0),value=mvindex(key_value,1)
| eval {key}=value
| stats values(*) as *
| fields - key value key_value key_value_combined
... View more