About kasis152

kasis152 · ‎02-05-2023

Thank you for replying : My raw data is : {"col1":"1","col2":"2","col3":"3","col4":"4","b":[{"col5":"5","col6":["6"]},{"col5":"55","col6":["66","666"]}]} What I wrote was like : | makeresults | eval _raw="{\"col1\":\"1\",\"col2\":\"2\",\"col3\":\"3\",\"col4\":\"4\",\"b\":[{\"col5\":\"5\",\"col6\":[\"6\"]},{\"col5\":\"55\",\"col6\":[\"66\",\"666\"]}]}" | spath | rename b{}.col5 as "col5", b{}.col6{} as "col6" | eval col5=mvjoin(col5,", "), col6=mvjoin(col6, ", ") | table col1 col2 col5 col6 Which Gave me like : col1 col2 col5 col6 1 2 5,55 6,66,666 But I want it like : col1 col2 col5 col6 1 2 5 6 1 2 55 66 1 2 55 666

kasis152 · ‎02-03-2023

Appreciate your help

kasis152 · ‎02-03-2023

The ultimate goal is to have the Dashboard in Tableau . Hence, wanted a formatted data.

kasis152 · ‎02-03-2023

@richgalloway Yes you were right , Raw data might help u better answer my question . but your query gave me such better shape . my visualization was kind of off . Can you help me rewrite the query , given that objective is still the save to obtain the same desired output as above. Correction: My raw data : {"col1":"1","col2":"2","col3":"3","col4":"4","b":[{"col5":"5","col6":["6"]},{"col5":"55","col6":["66","666"]}]}

kasis152 · ‎02-03-2023

I have the raw data in format : {"col1":"1",{col2":"2"},{.........(continue) which if I have to visualize using https://codebeautify.org/string-to-json-online : Object{1} ->a{4} col1: 1 col2: 2 col3: 3 col4: 4 ->b[3] ->0{3} col5:"5 col6[0] 0:6 ->1{3} col5: "55" col6[1] 0:66 ->2{3} col5: 55 col6[1] 0:666 And if my Splunk query is like index="api" | rename a.col1 as "col1",a.col2 as "col2", b{}.col5 as "col5", b{}.col6{} as "col6" | table "col1","col2","col5","col6" it display me: col1 col2 col5 col6 1 2 5 55 6 66 666 Moreover , if I export it in csv It only shows me first value of array(multi-value) col1 col2 col3 col4 1 2 5 6 but should be like : (each row 1:1 mapped) MY DESIRED TABLE col1 col2 col5 col6 1 2 5 6 1 2 55 66 1 2 55 666

kasis152 · ‎02-03-2023

One of my field in raw data is multivalue(like array) . I can see those values in a column in Splunk , but when I try to export them to csv then only the 1st value gets copied and rest disappears . eg: In Splunk col1 val1 val2 val2 val3 val4 While exporting col1 val1 val2

Posts	8
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎02-03-2023

Online Status	Offline
Date Last Visited	‎02-07-2023 02:49 PM

How to display all the values of the multi-value c...

How to extract all the multi-values in excel?

Re: How to extract all the multi-values in excel?

Re: How to display all the values of the multi-val...

Re: Display all the values of the multi-value colu...

Re: Display all the values of the multi-value colu...

How to display all the values of the multi-value c...

How to extract all the multi-values in excel?