Splunk Search

How do I operate on (and search from) sub-properties matching a pattern.

npxcomplete
New Member

I have messages that look like:

{ 
timers: {
      x.y.zaz{ count: 5 },
      x.y.waw{ count: 5 }
   }
}

I would like to run a search like:

timers.x.y.*a*.count | sum > 5

Is there a way I can express this? It does not need to be very efficient.

Tags (3)
0 Karma

woodcock
Esteemed Legend

Show us 5 sample events and a mockup of your desired output.

0 Karma

aohls
Contributor

I am not sure what you are looking for but assuming you are looking for the value 5. You could do a regex on that field first maybe.

| rex field=_raw "count: (?<timerCount>\d+)"

With that you can then check: timerCount > 5

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...