topic Re: How do you Filter events from Json? in Getting Data In

How do you Filter events from Json?

ppanchal — Thu, 03 Jan 2019 16:02:02 GMT

Below is my JSON. I want to display all events where responseTime >11.

Please assist.

log:    {   [-] 
         actionCd:   Update 
         appSourceCd:    MAS    
         appTargetCd:    OCS    
         contextID:  daa095c0-6e9b-1abf-970a-fffffc8664b7   
         correlateID:    1149623816 
         customUID:  05248008   
         interfaceName:  wm_businessservices.customerService.flowServices:publishSvcReqEvents   
         requestTypeCd:  SvcReq2    
         responseTime:   9

Re: How do you Filter events from Json?

alonsocaio — Thu, 03 Jan 2019 17:31:06 GMT

Have you tried to extract the fields you need to your search?

Re: How do you Filter events from Json?

alonsocaio — Thu, 03 Jan 2019 17:38:53 GMT

You can try to extract new fields for this events, in this case, you will need to extract the responseTime field.

It is possible to extract new fields using regex or delimiters, and you can access the extraction field menu by clicking in Event Actions -> Extract Fields, in the result of your search.

If it works, you will be able to filter your search using the new extracted field.

Re: How do you Filter events from Json?

Vijeta — Fri, 04 Jan 2019 18:00:00 GMT

If you use sourcetype as pre-defined for json in splunk it should be auto extracted. Else you will have to create field extractions or regex.