Splunk Search

How do I operate on (and search from) sub-properties matching a pattern.

New Member

I have messages that look like:

timers: {
      x.y.zaz{ count: 5 },
      x.y.waw{ count: 5 }

I would like to run a search like:

timers.x.y.*a*.count | sum > 5

Is there a way I can express this? It does not need to be very efficient.

Tags (3)
0 Karma

Esteemed Legend

Show us 5 sample events and a mockup of your desired output.

0 Karma


I am not sure what you are looking for but assuming you are looking for the value 5. You could do a regex on that field first maybe.

| rex field=_raw "count: (?<timerCount>\d+)"

With that you can then check: timerCount > 5

0 Karma