topic Re: Search Query Specific Values in Splunk Search

Search Query Specific Values

msarkaus — Thu, 11 Jul 2024 18:22:59 GMT

Hello,

I'm trying to only capture and show only the time it took for the service to complete. Shown below, is is a record that says the service completed in 1901 ms.

If you could please help write a search query to identify and return records into my dashboard panel that exceed 1909 ms?

So, for example, if there are 10 records that exceed 1900 ms, it will look something like this:

GetRisk completed in 1909 ms

GetRisk completed in 1919 ms

GetRisk completed in 2001 ms

GetRisk completed in 2100 ms

As so on.....

msgTxt returns:

VeriskService - GetRisk completed in 1909 ms. (request details: environment: Production | desired services: BusinessOwnersTerritory | property type: Commercial xxxxx)

Thank you

Re: Search Query Specific Values

PickleRick — Thu, 11 Jul 2024 18:29:57 GMT

And what have you tried so far? And what fields you have parsed out from those events?

Re: Search Query Specific Values

marnall — Thu, 11 Jul 2024 21:52:00 GMT

Assuming that each event has one of those "GetRisk completed..." lines, you could use this regex and where combination:

index = yourindex <other filters like sourcetype, etc> | rex field=_raw "GetRisk completed in (?<ms>\d+) ms" | where ms > 1900