Splunk Enterprise

How can I return all elements greater than or less than?

tsushi
Explorer

Hi,

I'm new to Splunk so this is really basic.
I can use this search

host=PChistory_1 participant_count=5

and I will get all elements where participant_count is exactly 5.
But, greater than or less than does not work.

host=PChistory_1 participant_count<5

will give me no results.

Not sure what I'm doing wrong.

This is example of one log element:

{
        "name": "Company xx", 
        "participant_count": 2, 
        "start_time": "2018-03-16T14:26:08", 
        "service_type": "conference", 
        "participants": [
            "/api/admin/history/v1/participant/149a6a3c-fb22-436a-b267-f649c131f1d6/", 
            "/api/admin/history/v1/participant/35e86e0e-f470-4259-8a5f-4f4b47c97d41/"
        ], 
        "tag": "", 
        "end_time": "2018-03-16T14:30:15.104681", 
        "instant_message_count": 0, 
        "unique_participant_count": 2, 
        "duration": 247, 
        "id": "c12509d6-ab15-49e2-9e38-38c551096cc8", 
        "resource_uri": "/api/admin/history/v1/conference/c12509d6-ab15-49e2-9e38-38c551096cc8/"
    }
0 Karma
1 Solution

tiagofbmm
Influencer

Are you indexing this with sourcetype JSON?

I picked up your exact example, indexed with JSON and tried both:

host=PChistory_1 participant_count=2

and

 host=PChistory_1 participant_count>1

And got the expected behaviour on both.

Please check that sourcetype and let me know

View solution in original post

tiagofbmm
Influencer

Are you indexing this with sourcetype JSON?

I picked up your exact example, indexed with JSON and tried both:

host=PChistory_1 participant_count=2

and

 host=PChistory_1 participant_count>1

And got the expected behaviour on both.

Please check that sourcetype and let me know

tsushi
Explorer

This was the problem indeed. I thought I had chosen JSON the first time and chosen my timestamps. Did it again now and it works beautifully 🙂 Not sure what I did wrong the first time, but probably some basic mistake.

0 Karma

elliotproebstel
Champion

The answer below from @tiagofbmm should work, but it's not as efficient as filtering in the base search. I'm surprised that the query you posted isn't working, because such structure works in my environment. Does it return no results at all, or just fail to return some results you know it should be returning?

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...