Get latest events of json and visualize it to table.

[alexeysharkov]

Hello friends!

I get JSON like this

{"key":"27.09.2023","value_sum":35476232.82,"value_cnt":2338}

and so on

...

{ [-]
   key: 29.09.2023
   value_cnt: 2736

   value_sum: 51150570.59
}

аnd row_source like this

10/4/23 1:23:03.000 PM

{"key":"27.09.2023","value_sum":35476232.82,"value_cnt":2338} Show syntax highlighted host = app-damu.hcb.kz source = /opt/splunkforwarder/etc/apps/XXX/pays_7d.sh sourcetype = damu_pays_7d

And i want to get table like this:

days	sum	cnt
27.09.2023	35476232.82	2338
29.09.2023	51150570.59	2736

so i have to get latest events and put it to table.

Please help

[alexeysharkov]

Sorry i forget to write very important things

I have many events with the same key 

for example:

10/4/23 1:23:03.000 PM	{"key":"27.09.2023","value_sum":35476232.82,"value_cnt":2338} Show syntax highlighted host = app-damu.hcb.kz source = /opt/splunkforwarder/etc/apps/XXX/pays_7d.sh sourcetype = damu_pays_7d
10/4/23 1:24:03.000 PM	{"key":"27.09.2023","value_sum":35476232.82,"value_cnt":2338} Show syntax highlighted host = app-damu.hcb.kz source = /opt/splunkforwarder/etc/apps/XXX/pays_7d.sh sourcetype = damu_pays_7d
10/4/23 1:25:03.000 PM	{"key":"27.09.2023","value_sum":35476232.82,"value_cnt":2338} Show syntax highlighted host = app-damu.hcb.kz source = /opt/splunkforwarder/etc/apps/XXX/pays_7d.sh sourcetype = damu_pays_7d

...

and for other KEY  for example key":"29.09.2023" many events

in the result i want to see only one unique row for KEY

I try to search 

index=hcg_app_damu_prod sourcetype="damu_pays_7d" | spath input=json | table _time, key ,value_sum, value_cnt | stats latest(key), latest(value_sum) ,latest(value_cnt)

but it give me just only one row.

[ITWhisperer · Accepted solution]

| stats latest(value_sum) ,latest(value_cnt) by key

[ITWhisperer]

Do you already have the fields extracted, or are you asking how to extract the fields so you can use them in a table?

[yuanliu]

This is rather confusing.  It seems that Splunk already gives you fields "key", "value_sum", and "value_cnt".  You want to rename "key" as "day", "value_sum" as "sum", "value_cnt" as "cnt".  Is that all?  Are you just looking for rename?

| rename "key" as "day", "value_sum" as "sum", "value_cnt" as "cnt"
| table day sum cnt

Something like that.