Splunk Search

Filter events by length of json field

ShagVT
Path Finder

I'm trying put together a query to find some outlier events with very long values within a complex structure.

 

index=myindex sourcetype=jsonfile
| where len('x.y.z{}.field') > 20
| stats count by x.y.z{}.field

 

This is my first stab at how to do this, but it doesn't return any values, even though I know they are there.

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I thought this was the same as my struggle with dereferencing JSON paths but it is not.  This has to do with using len() in where command with multivalue.  Here's a working filter:

|where isnotnull(len('x.y.z{}.field') > 20)
|stats count by x.y.z{}.field

Note, however, that count by an array field is not going to work too well if all you care are the values in the array whose length is greater than 20.  In that case you'll have to apply the filter again after stats, like

|where isnotnull(len('x.y.z{}.field') > 20)
|stats count by x.y.z{}.field
|where isnotnull(len('x.y.z{}.field') > 20)

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...