Json Format ↓
{
"device":"A123",
"data":"28745637",
"time":"1505924687",
}
"2874" = 28.74 , means tempurature , and "5637" = 56.37% humidity .
How to display as below↓
if ( tempurature > 25 & humidity >50)
{
display matching data ;
}
Thanks , My problem has been successfully resolved !!
your query to return events
| rex "data\"\:\"(?<temp>\d{4})(?<humid>\d{4})"
| search temp>2500 and humid>5000
If you want the percentages to display then you can add following to above and table the evals.
| eval temperature=round(temp/100,2)
| eval humidity=round(humid/100, 2)
| table temperature, humidity
In transforms.conf (to extract temperature and humidity fields)
REGEX = "data":"(?P<temperature>\d{4})(?P<humidity>\d{4})
You can than do an eval like the following:
| eval temp=round(temperature/100, 2)
I'll keep poking around to see how to insert a decimal into the field, but not sure how to do that right now:)
@sshelly - something like this should work. I don't believe the .
needs escaped in the format.
[temp]
REGEX = "data":"(\d{2})(\d{2})
DEST_KEY = temperature
FORMAT = \1.\2
[humid]
REGEX = "data":"\d{4}(\d{2})(\d{2})
DEST_KEY = humidity
FORMAT = \1.\2