I have some log files which I'm serializing into a JSON object and sending it to a Splunk App dashboard (through HTTP Event Collector).
The data is displayed on the dashboard as shown below:
data: { [-]
b1: FDh
b2345: 00 00 00 00
eid: 31h
msg: 00h
serialNo: 1
sev: 00h
sid: 03h
sta: FEh
timeStamp: 2019-04-29T12:55:46
}
(I don't have any files that I can upload and perform searching. I'm using code to read some text files and converting them to JSON which is directly sent to the Splunk server)
Is there a way to create graphs/charts using this data on the dashboard?
If you set KV_MODE = json
in props.conf for your sourcetype, all the fields should be available for you to use and dashboard upon.