hi, i got data like this
{
"source": "sadmin",
"sysinfo": {
"ram": [
{
"name": "ram",
"usage": 1243
},
{
"name": "ram0",
"usage": 1215
},
{
"name": "ram1",
"usage": 2151
}
],
}
}
i need to create a barchart from these data like img below:
Can any one help me please !
@cuongnguyen112
Can you please try this?
YOUR_SEARCH | rename sysinfo.ram{}.* as * | eval tmp =mvzip(name,usage) | mvexpand tmp | eval name=mvindex(split(tmp,","),0),usage=mvindex(split(tmp,","),1) | table name usage
My Sample Search:
| makeresults | eval _raw="{\"source\": \"sadmin\",\"sysinfo\": {\"ram\": [{\"name\": \"ram\",\"usage\": 1243},{\"name\": \"ram0\",\"usage\": 1215},{\"name\": \"ram1\",\"usage\": 2151}],}}" | extract | rename sysinfo.ram{}.* as * | eval tmp =mvzip(name,usage) | mvexpand tmp | eval name=mvindex(split(tmp,","),0),usage=mvindex(split(tmp,","),1) | table name usage
Thanks
@cuongnguyen112
Can you please try this?
YOUR_SEARCH | rename sysinfo.ram{}.* as * | eval tmp =mvzip(name,usage) | mvexpand tmp | eval name=mvindex(split(tmp,","),0),usage=mvindex(split(tmp,","),1) | table name usage
My Sample Search:
| makeresults | eval _raw="{\"source\": \"sadmin\",\"sysinfo\": {\"ram\": [{\"name\": \"ram\",\"usage\": 1243},{\"name\": \"ram0\",\"usage\": 1215},{\"name\": \"ram1\",\"usage\": 2151}],}}" | extract | rename sysinfo.ram{}.* as * | eval tmp =mvzip(name,usage) | mvexpand tmp | eval name=mvindex(split(tmp,","),0),usage=mvindex(split(tmp,","),1) | table name usage
Thanks
Thank you, that's totally what is need