topic How do I operate on (and search from) sub-properties matching a pattern. in Splunk Search

How do I operate on (and search from) sub-properties matching a pattern.

npxcomplete — Thu, 03 Oct 2019 04:23:47 GMT

I have messages that look like:

{ 
timers: {
      x.y.zaz{ count: 5 },
      x.y.waw{ count: 5 }
   }
}

I would like to run a search like:

timers.x.y.*a*.count | sum > 5

Is there a way I can express this? It does not need to be very efficient.

aohls — Thu, 10 Oct 2019 15:26:10 GMT

I am not sure what you are looking for but assuming you are looking for the value 5. You could do a regex on that field first maybe.

| rex field=_raw "count: (?<timerCount>\d+)"

With that you can then check: timerCount > 5

woodcock — Tue, 15 Oct 2019 00:13:59 GMT

Show us 5 sample events and a mockup of your desired output.