Hello,
I am fairly new to using splunk. I am having some trouble understanding how to extract the fields.
My sample data looks somewhat like this:
...Event={request=Request{data={firstName=jane, lastName=doe, yearOfBirth=1996}}}...
I want to get count based on yearOfBirth. How should I do it?
I tried doing stats count by request.data.yearOfBirth, and also tried simply doing stats count by yearOfBirth but neither returned any results. Am I accessing the yearOfBirth field incorrectly?
How can I
Check what fields are available in your data by checking field sidebar (left hand panel when you run your search). You can click on a field so see what way the field should be referred.
If you don't see any relevant field extracted, make sure that you're using correct Search mode (dropdown below time range picker, select Smart Mode OR Verbose Mode). If you still don't see a field for yearOfBirth, try this
your base search (index=x sourcetype=y)
| rex "yearOfBirth\=(?<yearOfBirth>\d+)"
| stats count by yearOfBirth