topic Re: How to write a search to return events with a variable field value greater than a certain number? in Splunk Search

How to write a search to return events with a variable field value greater than a certain number?

snabel — Sun, 23 Nov 2014 09:41:55 GMT

Hi,

I've this log entry:

"2014-11-22 02:42:10,545 .. - average:2.74425 , min:1.43 , max:4.007..."

i want to create a search query that returns all log entries with "average > 5"

i want to select the date of the log entry and the average value,

can this be done? how can i do this?

Thanks,
Snabel

Re: How to write a search to return events with a variable field value greater than a certain number?

martin_mueller — Sun, 23 Nov 2014 11:24:59 GMT

Sure:

index=foo sourcetype=bar average>5 | table _time average

Re: How to write a search to return events with a variable field value greater than a certain number?

snabel — Sun, 23 Nov 2014 11:33:06 GMT

it didn't work. i got:
No results found.

even though i have many log entries:
"2014-11-22 02:42:10,545 .. - average:5.34425 , min:1.43 , max:4.007..."
"2014-11-22 02:42:10,545 .. - average:5.36425 , min:1.43 , max:4.007..."

Re: How to write a search to return events with a variable field value greater than a certain number?

martin_mueller — Sun, 23 Nov 2014 11:48:27 GMT

Did you already extract the average field?

If not, go to Settings -> Fields -> Field Extractions -> New, enter "average" as name, fill in your sourcetype, and use this as inline extraction:

average:(?<average>\d+\.?\d*)

Then try again. By default, Splunk extracts key=value but not key:value.

Re: How to write a search to return events with a variable field value greater than a certain number?

snabel — Tue, 25 Nov 2014 11:33:56 GMT

Thanks it worked 🙂

Re: How to write a search to return events with a variable field value greater than a certain number?

snabel — Tue, 25 Nov 2014 15:14:53 GMT

i think i found it:
language: (?[a-z][a-z]+-+[a-z][a-z]*)