How can I query through CLI to return the value of...

Splunk Enterprise

Hello.

I have an index of Akamai logs forwarded to Splunk, and I'm trying to query for origin latency, which is a json object (netPerf.netOriginLatency) in these logs.

How can I query through CLI to return the value of this object for a minute for example (average latency per minute)? First, I tried to query just for the object value (without time filters) with 'spath' as shown below, but it didn't work:

./splunk search 'index=akamai message.fwdHost=someservice.mydomain.com | spath=netPerf.netOriginLatency'

How could I do that? Is it possible?

Best,

Get Updates on the Splunk Community!

How can I query through CLI to return the value of this object for a minute for example (average latency per minute)?

using Splunk Enterprise

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

Splunk Answers Content Calendar, July Edition I

Are you a member of the Splunk Community?

How can I query through CLI to return the value of this object for a minute for example (average latency per minute)?

using Splunk Enterprise

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

Splunk Answers Content Calendar, July Edition I