topic Re: List element by a specific value in Splunk Search

How to list element by a specific value?

sdhiaeddine — Mon, 06 Feb 2023 17:58:30 GMT

Hi,

I have this table of data:

Name	Age	Address
Mark	21	1 st xxxxx
Elisabeth	21	2 st xxxxx
Jane	22	3 st xxxxx
Bryan	24	4 st xxxxx

I want to list only the elements having a specific age. Exp: list of person with Age=21

Name	Age	Address
Mark	21	1 st xxxxx
Elisabeth	21	2 st xxxxx

Thanks for your help.

Re: List element by a specific value

gcusello — Mon, 06 Feb 2023 16:15:13 GMT

Hi @sdhiaeddine,

if these ields are already correctly extracted you can put the condition in the main search:

index=your_index Age="21" | table Name Age Address

if the fields aren0t already extracted, you should share some samples of your logs to create the extracting regex.

i hint to follow the Splunk Search Tutorial (https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial) to be authonomous in this kind of searches

Ciao.

Giuseppe

Re: List element by a specific value

sdhiaeddine — Mon, 06 Feb 2023 16:23:15 GMT

Hi @gcusello,

Actually I run this to extract the data from a json like this:

{ "list_element": [ { "Address": "3 st xxxxx", "Age": "22", "Name": "Jane" }, { "Address": "2 st xxxxx", "Age": "21", "Name": "Elisabeth" }, { "Address": "1 st xxxxx", "Age": "21", "Name": "Mark" } ] }

index=* | stats values(list_element) as list_element by database
| spath input=list_element
| table Name Age Address

I guess, I need to set a condition after the "spath"?

Re: List element by a specific value

gcusello — Mon, 06 Feb 2023 16:27:37 GMT

Hi @sdhiaeddine,

the spath ommand must be before the stats command:

index=* | spath | where Age="21" | table Name Age Address

index=* | spath | stats max(Age) AS Age values(Address) AS Address BY Name | where Age="21" | table Name Age Address

Ciao.

Giuseppe