Splunk Search

Trouble creating column chart based off 1 event

sam_
Engager

Hi,

I am attempting to create a simple column chart using JSON data from a single event.

The Rows{}.S03PERFC value represents a percent number... I have attempted to convert this but still can't seem to get it to display as a chart.

For some reason the fields are greyed out at the bottom.

Anything obvious I'm missing here?

sam__0-1624608708938.png

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The clue is in the title - you only have one event. You should try expanding the Rows{} collection before extracting the fields within it

| spath output=Rows path=Rows{}
| mvexpand Rows
| spath input=Rows

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

The clue is in the title - you only have one event. You should try expanding the Rows{} collection before extracting the fields within it

| spath output=Rows path=Rows{}
| mvexpand Rows
| spath input=Rows

View solution in original post

sam_
Engager

Thanks @ITWhisperer  - that did the trick perfectly!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!