How do search fo fields after extraction?

wuming79 — Wed, 31 May 2017 04:24:51 GMT

I have created a search for the following on a data feed. The log will show in format below:
"2641328 [EPS-log-dispatcher-11] INFO 1.24978294676695149906 - {"Log Header": "{"endpointKeyHash":{"string":"MAz7MadOhr02tPt5vtZsSEy9FWw="},"applicationToken":{"string":"24978294676695149906"},"headerVersion":{"int":1},"timestamp":{"long":1495594584490},"logSchemaVersion":{"int":2}}", "Event": {"temperature":-1,"timeStamp":1495594583638}}"

I have a search to extract the fields I wanted as below and now I wanted to create an alert to trigger when temperature is above 50.
temperature sourcetype=kaa | rex field=_raw "\"endpointKeyHash\":{\"string\":\"(?[^\"])\".\"Event\": (?{.*})}$"| spath input=mydata | table _time, endpoint, temperature | eval threshold=50

Using the above example, I can't just add | temperature > 50. It says
"Search Factory: Unknown search command 'temperature'. "

How should I phrase my search?

Re: How do search fo fields after extraction?

dineshraj9 — Wed, 31 May 2017 04:36:07 GMT

You need to use it with where or search command -

<your search> | where temperature > 50

<your search> | eval threshold=50 | where temperature > threshold

<your search> | search temperature > 50

topic Re: How do search fo fields after extraction? in Splunk Enterprise

How do search fo fields after extraction?

Re: How do search fo fields after extraction?