Dashboards & Visualizations

Extracting simple array of strings

sankarms
Explorer

I have a simple entry in my logs like so:

types=["A","B","C"]

There are several entries like that throughout the logs. Another one could look like this:

types=["B","C"]

Is there a way to extract the values from this array of strings and create a bar chart out of the occurrences of each type? So if splunk only saw the above 2 long entries it would make a bar chart with

  • "# of occurrences" on the y-axis
  • "Types" on the x-axis

And it would show 1 for type A, 2 for type B and C.

What would be the search criterion?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could cheat by going through spath parsing JSON:

... | eval types = "{\"types\": " + types + "}" | spath input=types | rename types{} as types | stats count by types

Alternatively, a bit of regexing around:

... | eval types = replace(types, "(^\[\")|(\"\]$)", "")| makemv types delim="\",\"" | stats count by types

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You could cheat by going through spath parsing JSON:

... | eval types = "{\"types\": " + types + "}" | spath input=types | rename types{} as types | stats count by types

Alternatively, a bit of regexing around:

... | eval types = replace(types, "(^\[\")|(\"\]$)", "")| makemv types delim="\",\"" | stats count by types

martin_mueller
SplunkTrust
SplunkTrust

What does the statistics table look like, and what visualization are you using?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Odd - what happens when you run this in an empty search bar?

| stats count | eval foo = "types=[\"A\",\"B\",\"C\"] types=[\"B\",\"C\"]" | makemv foo | mvexpand foo | rename foo as _raw | extract | eval types = replace(types, "(^\[\")|(\"\]$)", "")| makemv types delim="\",\"" | stats count by types
0 Karma

sankarms
Explorer

Sorry I'm an absolute idiot. I messed up something from your original command. It works perfectly fine now. Thank you.

0 Karma

sankarms
Explorer

this doesn't extract the individual types separately. This gives back the whole list like so

["A","B","C"]

and counts it as 1 object.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...