title: How to parse JSON metrics array in Splunk
body: <p>I receive JSON from API in the following format:</p>
  
  <pre><code>[
      {
      "scId": "000DD2",
      "sensorId": 2,
      "metrics": [
          {
              "s": 5414,
              "dateTime": "2018-02-02T13:03:30+01:00"
          },
          {
              "s": 5526,
              "dateTime": "2018-02-02T13:04:56+01:00"
          },
          {
              "s": 5631,
              "dateTime": "2018-02-02T13:06:22+01:00"
          }
  }, .... ]
  </code></pre>
  
  <p>Currently trying to display these metrics on the linear chart with dateTime for the X-axis and "s" for Y.</p>
  
  <p>I use the following search query:</p>
  
  <pre><code>index="main" source="rest://test3" | spath input=metrics{}.s| mvexpand metrics{}.s
  | mvexpand metrics{}.dateTime | rename metrics{}.s as s 
  | rename metrics{}.dateTime as dateTime| table s,dateTime
  </code></pre>
  
  <p>And I receive the data in the following format which is not applicable for linear chart. The point is - how to correctly parse the JSON to apply date-time from <code>dateTime</code> field in JSON to <code>_time</code> in Splunk.</p>
  
  <p><a href="https://i.stack.imgur.com/TosyV.png" rel="nofollow noreferrer">Query results</a></p>