Splunk Search

How do I make a Splunk query to find where X is greater than 0?

compguy
New Member

I have a log: "TOTAL NUMBER OF RECORDS IS:0"

I need to Query it in a way that it finds a log message if the number of records turns out to be more than 0.

I have tried the following

sourcetype = Mylogs | rex "\d+:\d+:\d+\s(?< TOTAL NUMBER OF RECORDS IS:>\d+)$" | where TOTAL NUMBER OF RECORDS IS:>=25

It gives a terminator Error. I have tried with it does not show up. Is there a way?

0 Karma
1 Solution

damann
Communicator

I guess your provided log example is just a part of the original event.

Try the following query for your regex:

basesearch | rex "TOTAL NUMBER OF RECORDS IS:(?<totalRecords>\d+)" | where totalRecords >= 25

View solution in original post

0 Karma

damann
Communicator

I guess your provided log example is just a part of the original event.

Try the following query for your regex:

basesearch | rex "TOTAL NUMBER OF RECORDS IS:(?<totalRecords>\d+)" | where totalRecords >= 25

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are a few things wrong with that query.

  • The regular expression looks for 3 sets of digits separated by colons. That doesn't match your example. Try TOTAL NUMBER OF RECORDS IS:(?<field>\d+). You may even get by with :(?\<field>d+).
  • The field name in your query should not have spaces in it. Try something like TotalNumberOfRecords.
  • Field names can't contain colons. That's probably the source of the error message.

Try this query: sourcetype=mylogs | rex ":\d+(?<TotalNumberOfRecords>\d+)" | where TotalNumberOfRecords>=25

---
If this reply helps you, Karma would be appreciated.
0 Karma

compguy
New Member

That query throws a field too long error

0 Karma

compguy
New Member

But :(?\<field>d+) works

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...