https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-extract-these-field-values-from-my/m-p/258857#M77574 <P>May need <CODE>spath</CODE> before rename?</P> Wed, 13 Jul 2016 19:18:36 GMT sundareshr 2016-07-13T19:18:36Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-extract-these-field-values-from-my/m-p/258855#M77572 <P>Below is my applogs data:</P> <PRE><CODE>{"name":"blink-api-manager","submodule":"perfLogger","level":30,"req":{"url":"/api/accounts/transfers/retrieveAccounts","method":"GET","uuid":"ciqki748r0ur3tvmx6nlh7k3s"},"APIResponseTime":{"AccountsView.findByCustomerId":{"api":892.391628}},"OverallResponseTime":894.698927,"msg":"","time":"2016-07-13T06:26:24.069Z","v":0} </CODE></PRE> <P>I have more than 20K data and need to filter 4 values: URL - APIResponseTime - OverallResponseTime - Time orderwise and need to download it in a CSV format. How it can be done?</P> Wed, 13 Jul 2016 11:31:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-extract-these-field-values-from-my/m-p/258855#M77572 sathishsathiyam 2016-07-13T11:31:54Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-extract-these-field-values-from-my/m-p/258856#M77573 <P>Run following search and export result as csv</P> <PRE><CODE>Your base search | rename req.* as * | table url APIResponseTime OVerallResponseTime time </CODE></PRE> <P>See this for export method<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/Search/Exportsearchresults#Export_data_using_Splunk_Web">http://docs.splunk.com/Documentation/Splunk/6.4.1/Search/Exportsearchresults#Export_data_using_Splunk_Web</A></P> Wed, 13 Jul 2016 18:11:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-extract-these-field-values-from-my/m-p/258856#M77573 somesoni2 2016-07-13T18:11:11Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-extract-these-field-values-from-my/m-p/258857#M77574 <P>May need <CODE>spath</CODE> before rename?</P> Wed, 13 Jul 2016 19:18:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-extract-these-field-values-from-my/m-p/258857#M77574 sundareshr 2016-07-13T19:18:36Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-extract-these-field-values-from-my/m-p/258858#M77575 <P>The data looks like a valid JSON , if the sourcetype is configured correctly then the JSON should be parsed correctly with fields already available. But you're correct if that's not the case. Sathish to confirm how his logs are setup/looking in Splunk.</P> Wed, 13 Jul 2016 19:29:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-extract-these-field-values-from-my/m-p/258858#M77575 somesoni2 2016-07-13T19:29:01Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-extract-these-field-values-from-my/m-p/258859#M77576 <P>Thanks for the info, it just worked with table command itself. </P> Thu, 14 Jul 2016 05:11:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-extract-these-field-values-from-my/m-p/258859#M77576 sathishsathiyam 2016-07-14T05:11:28Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-extract-these-field-values-from-my/m-p/258860#M77577 <P>Yes its a valid JSON and since fields were already available, splunk parsed it correctly</P> Thu, 14 Jul 2016 05:13:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-extract-these-field-values-from-my/m-p/258860#M77577 sathishsathiyam 2016-07-14T05:13:11Z