Thank you! Works well. I'm struggling to get the last date value to calculate the percentage deviation. Could you please help ... View more

I did attach the query what i tried and screenshots of how i makeresults and how json files look like. Basically, I would like to compare today's 95th percentile with previous day or some other day 95th percentile to check for deviation. Also, this json file has been generated by jmeter file using jtl file. Please let me know if you know any way to generate the report in splunk using jtl file index=jenkins_artifact source="job/V8_JMeter_Load_Test_STAGE_Pipeline/*/src/TestResults/*/JMeter/RUN2/statistics.json" | spath | eval date = strftime(_time, "%m-%d %k:%M") | eval "Transaction Name"=mvindex(split(transaction,"."),0) | eval pct2ResTime = round(pct2ResTime) | untable date "Transaction Name" pct2ResTime | xyseries "Transaction Name" date pct2ResTime       ... View more

Thank you for your help! but I'm unable to produce the table with this query. ... View more

No! I did not try with spath. Query i tried so far is below. Also,  Could you please help with spath, I'm very new to splunk index=jenkins_artifact source="<path to json>/statistics.json" | rex max_match=0 "(?<keyvalue>\"[^\"]+\":\"[^\"]+\")" | mvexpand keyvalue | rex field=keyvalue "\"(?<key>[^\"]+)\":\"(?<value>[^\"]+)\"" | eval {key}=value | fields - keyvalue key value _raw host eventtype index linecount source sourcetype punct splunk_server tag tag::eventtype timestamp | untable date Transaction pct2ResTime | where like(Transaction,"%__%") | xyseries Transaction date pct2ResTime ... View more

@scelikok No luck. I have attached outcome screenshot for your reference | search job_name=*Group06* OR job_name=*Group01* - This produce 2 events, 1st one belong to Group06 2nd event belong to Group01 | search job_name=*Group06* OR job_name=rerunGroup - This produce only 1 event belong to Group06    ... View more

@ITWhisperer Can you please help with my above question? Thanks in advance! ... View more

Due to character limitation in the blog i removed assetPortfolio_Verify prefix in the name example: "AssetDetailsPage":"passed", should be "assetPortfolio_VerifyAssetDetailsPage":"passed", < { "AssetDetailsPage":"passed", "AddAsset_OTHERDistributor":"passed", "AddAssetForOthers":"passed", "AddAssetValidationDetailsOboUser":"passed", "AddLocationDetailsFields_SUMAUser":"passed", "AddLocationUIChangesOboUser":"passed", "AddLocationDetailsFields":"passed", "AddAssetValidationDetailsSumaUser":"passed", "AddLocationUIChangesSumaUser":"passed", "AddPropertyValidationDetails":"passed", "NoResultsMessage":"passed", "AssetFilters":"passed", "EditFunctionality":"passed", "APMManageAssetTab":"passed", "AddAssetValidationDetails":"passed", "AddAssetLabels":"passed", "AddLocationUIChanges":"passed", "InvalidFormatOnPurchaseDateFiled":"passed", "APMPropertyDropdown":"passed", "SearchOnManageAsset":"broken", "AddPropertyValidationDetailsForOboUser":"passed", "AddPropertyValidationDetailsForSumaUser":"passed", "AssetDetailsDateFieldsInvalidErrors":"passed", "AssetDetailsDateFieldsInvalidErrors_SUMAUser":"passed", "AssetDetailsToolTipOnAddEditCopyLocation":"broken", "ChangeLocationDetailsFields":"broken", "ChangeLocationDetailsFieldsOboUser":"passed", "ChangeLocationDetailsFieldsSumaUser":"failed", "ChangeLocationUIChangesDetailsFields":"passed", "ChangeLocationUIChangesDetailsFieldsOboUser":"passed", "ChangeLocationUIChangesDetailsFieldsSumaUser":"passed", "CopyLocationAllDetailsFields":"passed", "CopyLocationAllDetailsFieldsOboUser":"passed", "CopyLocationAllDetailsFieldsSumaUser":"passed", "CopyLocationUIChanges":"passed", "CopyLocationUIChangesOboUser":"passed", "CopyLocationUIChangesSumaUser":"passed", "EditAssetValidationDetails":"passed", "EditAssetValidationDetailsOboUser":"passed", "EditAssetValidationDetailsSumaUser":"passed", "EditLocationAllDetailsFields":"passed", "EditLocationAllDetailsFieldsOboUser":"passed", "EditLocationAllDetailsFieldsSumaUser":"passed", "EditLocationUIChanges":"passed", "EditLocationUIChangesOboUser":"passed", "EditLocationUIChangesSumaUser":"passed", "EditPropertyValidationDetails":"passed", "EditPropertyValidationDetailsOboUser":"passed", "EditPropertyValidationDetailsSumaUser":"passed", "FieldSonAddAsset_OTHERDistributor":"passed", "LabelsUnderLocationsWithValues":"broken", "ListOfPropertiesInPropertyTypeDropdown_AddProperty":"passed", "ListOfPropertiesInPropertyTypeDropdown_EditProperty":"passed", "ManufacturerComponentOnManageAssets":"passed", "PerformanceDataFieldsInvalidErrors":"passed", "PerformanceDataFieldsInvalidErrors_SUMAUser":"passed", "PropertiesListInSortedOrder":"passed", "PurchaseDateFiled_AddLocationModal":"passed", "PurchaseDateFiled_CopyLocationModal":"passed", "PurchaseDateFiled_EditLocationModal":"passed", "RemoveLocationUIChanges":"passed", "RemoveLocationUIChangesOboUser":"passed", "RemoveLocationUIChangesSumaUser":"passed", "BulkUploadNarrativeOnAddAssetModal":"passed", "BulkUploadOnManageAssetPage":"passed", "BulkUploadPageDetails":"passed", "BulkUploadPageNameFromManageAssetsPage":"passed", "BulkUploadPageNameFromManageAssetsPage_OBO":"passed", "BulkUploadPageNameFromManageAssetsPage_SUMA":"passed", "BulkUploadTab":"passed", "PageNamesOnBulkUploadPages":"passed", "PageNamesOnBulkUploadPages_OBO":"passed", "PageNamesOnBulkUploadPages_SUMA":"passed", "TabsOnBulkUploadPage":"passed", "AssetCountOnDashboard":"passed", "BETAOnMyAssetManager":"passed", "BETATextOnMyAssetManager_NonAPMUser":"passed", "DashboardAssetLifeStatusNewTable":"passed", "DashboardAssetLifeStatusNewTableOboUser":"broken", "DashboardAssetLifeStatusNewTableSorting":"passed", "DashboardAssetLifeStatusNewTableSortingOboUser":"passed", "DashboardAssetLifeStatusNewTableSortingSumaUser":"broken", "DashboardAssetLifeStatusNewTableSumaUser":"passed", "DashboardAssetLifeStatusReplaceNowTable":"broken", "DashboardAssetLifeStatusReplaceNowTableOboUser":"passed", "DashboardAssetLifeStatusReplaceNowTableSumaUser":"passed", "DashboardAssetLifeStatusReplaceSoonTable":"passed", "DashboardAssetLifeStatusReplaceSoonTableOboUser":"passed", "DashboardAssetLifeStatusReplaceSoonTableSumaUser":"passed", "DashboardAssetLifeStatusStyleCardLayout":"broken", "DashboardAssetLifeStatusStyleCardLayoutOboUser":"broken", "DashboardAssetLifeStatusStyleCardLayoutSumaUser":"broken", "DashboardCategoryFilterFunctionalities":"passed", "DashboardCategoryFilterFunctionalities_OBOUser":"passed", "DashboardCategoryFilterWhenZeroAssets":"passed", "DashboardCategoryFilterWhenZeroAssets_OBOUser":"passed", "DashboardNewTableFunctionality":"passed", "DashboardNewTableFunctionalityOBOUser":"passed", "DashboardNewTableFunctionalitySumaUser":"passed", "DashboardPropertyFilterFunctionalities":"passed", "DashboardPropertyFilterFunctionalities_OBOUser":"passed", "DashboardPropertyFilterWhenZeroAssets":"passed", "DashboardPropertyFilterWhenZeroAssets_OBOUser":"passed", "DashboardReplaceNowTableFunctionality":"broken", "DashboardReplaceNowTableFunctionalityOboUser":"passed", "DashboardReplaceNowTableFunctionalitySumaUser":"passed", "DashboardReplaceNowTableSorting":"passed", "DashboardReplaceNowTableSortingOboUser":"passed", "DashboardReplaceNowTableSortingSumaUser":"passed", "DashboardReplaceSoonTableFunctionality":"passed", "DashboardReplaceSoonTableFunctionalityOboUser":"broken", "DashboardReplaceSoonTableFunctionalitySumaUser":"passed", "DashboardReplaceSoonTableSorting":"passed", "DashboardReplaceSoonTableSortingOboUser":"passed", "DashboardReplaceSoonTableSortingSumaUser":"passed", "AssetNameLinkInWarrantyExpiration":"passed", "DashboardPageRecentlyInstalledTab":"passed", "DashboardPageTabs":"passed", "DashboardWelcomeMessageWhenUserReturns":"passed", "DataDisplayedInRecentlyAdded":"passed", "EmptyStateAssetLifeStatusMessage":"passed", "EmptyStateMessagesOnDashboardPageTabs":"passed", "EmptyStateRecentlyAddedTabAndLinkToAddAssetModal":"passed", "HyperLinkAssetNameInRecentlyAdded":"passed", "ManagePropertyAsset":"passed", "ManufacturerWarrantyTypeInWarrantyExpiration":"passed", "RecentlyAddedTab":"passed", "RecentlyAddedTableColumns":"passed", "RecentlyInstalledTabData":"passed", "RecentlyInstalledTableColumnsData":"passed", "ServiceWarrantyTypeInWarrantyExpiration":"passed", "TopManufacturerSection":"passed", "WarrantyExpirationTabColumnsData":"passed", "SortingOnManageAssetsComponents":"passed", "UserAuthenticationToVideoResourcesPage":"passed", "VideoResourcesTabEspotAndVideoPlayWindow":"passed", "VideoResourcesTabOnMyAssetManager":"passed", "FilterSearchBasedOnCategory":"passed", "FilterSearchBasedOnDistributor":"broken", "IfLocationListEnabledInManageAssets":"passed", "AddLocationFields":"passed", "AddPropertyFields":"passed", "AssetPropertyValidation":"passed", "DisabledFieldsForNoAssets":"passed", "DisabledFieldsForNoLocation":"passed", "FloorPlanForAsset":"passed", "IfFieldUpdated":"passed", "NoResultMessage":"passed", "PLaceHolderText":"passed", "PropertyListTable":"passed", "PropertySorting":"failed", "SearchField":"passed", "TableRecords":"passed", "UpdateAsset":"passed", "APMPropertyDropdown":"passed", "AddLocationForHVAC":"passed", "AddNewLocationList":"passed", "AddNewProperty":"passed", "AscendingOrderInAssetTableColumn":"passed", "CancelBtnOnAddProperty":"passed", "CancelBtnOnEditProperty":"passed", "CloseModelOnAddAsset":"passed", "ComponentsOnManageAssets":"passed", "CopyComponentUnderLocation":"broken", "CreateAssetViewComponent":"broken", "CreatePageNameForManageProperties":"passed", "FloorPlanOnManageAssets":"passed", "LeftNavLink":"passed", "ManageProperties":"passed", "ManagePropertyLeftNavigationLinks":"passed", "MessageForNoLocationAvailable":"passed", "MousePointerAndNoHighlight":"passed", "NewFieldsLocation":"passed", "NewFieldsLocationOnHvac":"passed", "NoAssetAvailable":"passed", "NoPropertyAvailable":"passed", "RemoveLocation":"passed", "SearchOnManageAssetPage":"passed", "SearchWithInvalidCharacter":"passed", "PlaceholderTextSearchBox":"passed" } /> ... View more

I don't see any new line character. I have attached a snippet of the event. Please let me know how can I send event file (.json file). json is not supported attachment here.   ... View more

I checked complete json, don't see any duplicates. I see some solutions in the blog asking to switch from "INDEXED_EXTRACTIONS = JSON" to "KV_MODE = json". I'm not sure that will work in my case. https://community.splunk.com/t5/Splunk-Search/INDEXED-EXTRACTIONS-JSON-limiting-multivalued-fields-to-10/td-p/279893 ... View more

Thanks one more time. Interestingly, your recent query is fetching only 77 values where as i have 182 values in json file. Is this splunk limitation?   ... View more

Thanks Again! You're my saver Your query works. However, For some reason I see state twice. Also, i see source, host etc... being listed in the table   ... View more

Thanks again! Yes! Below json files are generated every day and I would like to show them in table format as below Source: Group01/1318/test.json Generated timestamp: 11/12 12:00 AM { "Portfolio_Validate1":"skipped", "Portfolio_Validate2":"passed", "Portfolio_Validate3":"passed", "Portfolio_Validate4":"broken" } Source: Group01/1319/test.json Generated timestamp: 11/13 12:00 AM { "Portfolio_Validate1":"passed", "Portfolio_Validate2":"passed", "Portfolio_Validate3":"passed", "Portfolio_Validate4":"broken" } Source: Group01/1320/test.json Generated timestamp: 11/14 12:00 AM { "Portfolio_Validate1":"passed", "Portfolio_Validate2":"failed", "Portfolio_Validate3":"passed", "Portfolio_Validate4":"passed" }   11/14 12:00 AM 11/14 12:00 AM 11/12 12:00 AM Portfolio_Validate1 passed passed skipped Portfolio_Validate1 failed passed passed Portfolio_Validate1 passed passed passed Portfolio_Validate1 passed broken broken   ... View more

Thank you for your inquiry. This is useful for isolated json files. However, this file is generated every day, and I'd like to display the latest 7 days' numbers in a table by date. ... View more

I'm new and learning, can you please help with below query I have json file with below data, I would like to get name and status and display it in table. Help here is much appreciated. I'm new to splunk Name                                                                                                Status assetPortfolio_ValidateAddAssetForOthers                    passed assetPortfolio_ValidatePLaceHolderText                         failure assetPortfolio_ValidateIfFieldUpdated                              passed { "name": "behaviors",  "children": [      {      "name": "assetPortfolio_ValidateAddAssetForOthers",      "status": "passed"      },      {      "name": "assetPortfolio_ValidatePlaceHolderText",      "status": "failure"      },      {      "name": "assetPortfolio_ValidateIfFieldUpdated",      "status": "passed"     }   ] } ... View more

Thanks. Solutions Works ... View more

Thanks. This works ... View more