如何构建从JSON数组中提取数据的Splunk查询

Question

我们有一系列splunk日志条目，并希望绘制"数据"；面板上的字段。

{
"Message": "Test Message",
"Timestamp":2022-09-30T14:06:01.8294071-05:00,
"Data": [{"Key":"key1","Value":"3"},{"Key":"key2","Value":"4"}]
}
{
"Message": "Test Message",
"Timestamp":2022-09-30T15:06:01.8294071-05:00,
"Data": [{"Key":"key1","Value":"4"},{"Key":"key2","Value":"3"}]
}
{
"Message": "Test Message",
"Timestamp":2022-09-30T17:06:01.8294071-05:00,
"Data": [{"Key":"key1","Value":"5"},{"Key":"key2","Value":"2"}]
}

我们希望在同一Splunk图上绘制关键点1和关键点2。文档显示了一种工作方式：https://docs.splunk.com/Documentation/Splunk/latest/Search/Chartmultipledataseries

从中获得如何处理数组数据的灵感https://community.splunk.com/t5/Splunk-Search/How-to-search-or-extract-specific-key-value-pair-from-array/m-p/590937#M205723我们已经尝试过：

index=myindex 
| bin _time 
| rename Data{} as data_*
| eval key1 = mvindex(data_Value,mvfind(data_Key,"key1"))
| eval key2 = mvindex(data_Value,mvfind(data_Key,"key2"))
| stats sum(key1) as key1sum, sum(key2) as key2sum by _time, source 
| eval s1="key1s key2s" 
| makemv s1 
| mvexpand s1 
| eval yval=case(s1=="key1s",key1sum,s1=="key2s",key2sum) 
| eval series=source+":"+s1 
| xyseries _time,series,yval

当我运行查询时，会发现事件，但不会生成统计信息。我怀疑问题在于从日志条目中读取数据。有人能帮我吗？

Answer 1

这里有一个生成结果的随处运行查询。我在使用rename命令时运气不佳，所以使用了"数据｛｝。"，相反

调试这样的问题需要一次运行一个查询命令，直到找到一个没有结果的命令。然后修复该命令并继续该过程，直到完成查询为止。

| makeresults
| eval data="{
"Message": "Test Message",
"Timestamp":"2022-09-30T14:06:01.8294071-05:00",
"Data": [{"Key":"key1","Value":"3"},{"Key":"key2","Value":"4"}]
};
{
"Message": "Test Message",
"Timestamp":"2022-09-30T15:06:01.8294071-05:00",
"Data": [{"Key":"key1","Value":"4"},{"Key":"key2","Value":"3"}]
};
{
"Message": "Test Message",
"Timestamp":"2022-09-30T17:06:01.8294071-05:00",
"Data": [{"Key":"key1","Value":"5"},{"Key":"key2","Value":"2"}]
}"
| eval data=split(data,";") 
| mvexpand data
| eval _raw=data, source="foo"
| fields - data
| spath 
```Everything above just sets up test data```
| eval key1 = mvindex('Data{}.Value',mvfind('Data{}.Key',"key1"))
| eval key2 = mvindex('Data{}.Value',mvfind('Data{}.Key',"key2"))
| stats sum(key1) as key1sum, sum(key2) as key2sum by _time, source 
| eval s1="key1s key2s" 
| makemv s1 
| mvexpand s1 
| eval yval=case(s1=="key1s",key1sum,s1=="key2s",key2sum) 
| eval series=source+":"+s1 
| xyseries _time,series,yval