Splunk Search

Creating dashboard with 4 columns

shenoyveer
Path Finder

Hi Team,

I am sending json data to Splunk server and I want to create a dashboard out of it.

My data is in the below format and I need help in creating the dashboard out of it.

 

example:

{"value": ["new-repo-1: 2: yes: 17", "new-repo-2: 30:no:10", "new-one-3:15:yes:0", "old-repo: 10:yes:23", "my-repo: 10:no:15"]} and many more similar entries.

 

my dashboard should look like,

reposcountactivecount
new-repo2yes17
new-repo-230no10
new-one-315yes0
old-repo10yes23
my-repo10no15

 

I am able to write the rex for single field using extract pairdelim="\"{,}" kvdelim=":" but not able to do it for complete dashboard.

can someone help?

 

Thanks,

Veeresh Shenoy

Labels (2)
0 Karma
1 Solution

shenoyveer
Path Finder

I got the query that we need to use dedup 

thanks anyway.

View solution in original post

0 Karma

shenoyveer
Path Finder

Thank you soo much @ITWhisperer 

this worked for me 🙂

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your data looks like JSON so perhaps you should start by extracting the value collection into a multivalue field. You can then use mvexpand to split it into separate events, and use rex to extract the fields. Note that you can't have two columns / fields with the same name as you have shown

| spath value{} output=value
| mvexpand value
| rex field=value "(?<repos>[^:]+):\s*(?<count>\d+):\s*(?<active>\w+):\s*(?<othercount>\d+)"
| table repos count active othercount

shenoyveer
Path Finder

This query worked but I have found one issue that its taking duplicate values in dashboard if we run it again

is there any way that we can avoid old value if we run multiple times in lesser time?

 

0 Karma

shenoyveer
Path Finder

I got the query that we need to use dedup 

thanks anyway.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...