Splunk Search
Highlighted

How do I make a Splunk query to find where X is greater than 0?

New Member

I have a log: "TOTAL NUMBER OF RECORDS IS:0"

I need to Query it in a way that it finds a log message if the number of records turns out to be more than 0.

I have tried the following

sourcetype = Mylogs | rex "\d+:\d+:\d+\s(?< TOTAL NUMBER OF RECORDS IS:>\d+)$" | where TOTAL NUMBER OF RECORDS IS:>=25

It gives a terminator Error. I have tried with it does not show up. Is there a way?

0 Karma
Highlighted

Re: How do I make a Splunk query to find where X is greater than 0?

SplunkTrust
SplunkTrust

There are a few things wrong with that query.

  • The regular expression looks for 3 sets of digits separated by colons. That doesn't match your example. Try TOTAL NUMBER OF RECORDS IS:(?<field>\d+). You may even get by with :(?\<field>d+).
  • The field name in your query should not have spaces in it. Try something like TotalNumberOfRecords.
  • Field names can't contain colons. That's probably the source of the error message.

Try this query: sourcetype=mylogs | rex ":\d+(?<TotalNumberOfRecords>\d+)" | where TotalNumberOfRecords>=25

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How do I make a Splunk query to find where X is greater than 0?

New Member

That query throws a field too long error

0 Karma
Highlighted

Re: How do I make a Splunk query to find where X is greater than 0?

New Member

But :(?\<field>d+) works

0 Karma
Highlighted

Re: How do I make a Splunk query to find where X is greater than 0?

Communicator

I guess your provided log example is just a part of the original event.

Try the following query for your regex:

basesearch | rex "TOTAL NUMBER OF RECORDS IS:(?<totalRecords>\d+)" | where totalRecords >= 25

View solution in original post

0 Karma