Splunk Search

How to edit my search to filter out JSON fields for an alert report?

New Member

Hi Folks,

I am attempting to look at some Splunk logs and within the JSON, I only care about 3 fields: cmd, vax, opcode. In this case, we want an alert to trigger any time a timeout occurs, and in the email, we want the manager to see which cmd, vax and opcode are associated with the timeout. Below is an example of a log:

[Fri Feb 26 10:07:29 2016] [error] [XoPolZO1CN2S8ubAvl7IoJ8tCF8] [2016-02-26,10:07:29.765] ServiceClient::Atlas: recv: {"header":{"result":"0x0","statmsg":"PASS","statcode":"0x0","cache":0,"mode":10,"quenum":"0x0","quewait":0,"querate":0,"sid":"XoPolZO1CN2S8ubAvl7IoJ8tCF8","bid":"rXUWZoJ7MwzAGQdrySIk8zhMwg0","cip":"","token":"0000000208050005000042754239A8C000000000022C2AA2EFE9A793","uid":"SYSTEMCALL"},"command1":

Here is my search thus far, but it's not removing any of the fields. We are trying to make the report as readable as possible.

index=yma source="/apt/local/logs/error_log" AND "vax" AND "cmd" AND "opcode" | fields cmd, vax, opcode, error*
0 Karma

Path Finder

Use the table command to reduce down your output to just the fields you care about.

index=yma source="/apt/local/logs/error_log" AND "vax" AND "cmd" AND "opcode" | table cmd, vax, opcode, error*

You might have to use the full JSON path for your fields depending on how you extracted/aliased the fields, for example:


0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!