How do you Filter events from Json?

[ppanchal]

Below is my JSON. I want to display all events where responseTime >11.

Please assist.

log:    {   [-] 
         actionCd:   Update 
         appSourceCd:    MAS    
         appTargetCd:    OCS    
         contextID:  daa095c0-6e9b-1abf-970a-fffffc8664b7   
         correlateID:    1149623816 
         customUID:  05248008   
         interfaceName:  wm_businessservices.customerService.flowServices:publishSvcReqEvents   
         requestTypeCd:  SvcReq2    
         responseTime:   9  

[Vijeta]

If you use sourcetype as pre-defined for json in splunk it should be auto extracted. Else you will have to create field extractions or regex.

[alonsocaio]

You can try to extract new fields for this events, in this case, you will need to extract the responseTime field.

It is possible to extract new fields using regex or delimiters, and you can access the extraction field menu by clicking in Event Actions -> Extract Fields, in the result of your search.

If it works, you will be able to filter your search using the new extracted field.

[alonsocaio]

Have you tried to extract the fields you need to your search?