Splunk Search

How do I operate on (and search from) sub-properties matching a pattern.

New Member

I have messages that look like:

timers: {
      x.y.zaz{ count: 5 },
      x.y.waw{ count: 5 }

I would like to run a search like:

timers.x.y.*a*.count | sum > 5

Is there a way I can express this? It does not need to be very efficient.

Tags (3)
0 Karma

Esteemed Legend

Show us 5 sample events and a mockup of your desired output.

0 Karma


I am not sure what you are looking for but assuming you are looking for the value 5. You could do a regex on that field first maybe.

| rex field=_raw "count: (?<timerCount>\d+)"

With that you can then check: timerCount > 5

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!