Splunk Search

How to extract string value and use comparison operators in a search?

akash_akkis
New Member

Hi I am new to splunk
I wanted to extract data from logs that have a particular string with a value and only return data where the extracted value is 100 or greater.

ID: 2999
Payload: {"Audit":{"__queryElapsedTime":"267","__requestReceived":"2014.09.04 06:01:04.560
Address: sdfjkjsdljsjdjjkljsd";k;lklsdk

Here is my logs I wanted to search ID , Payload , Address and list in table

ID Address Payload
2999 sdjsdjj;'lkdfj;ksfdk {"Audit":{"queryElapsedTime":"267","requestReceive

Please help me I am stuck with prod issue.

0 Karma

gfuente
Motivator

Hello

Try this:

your base search ... | rex "queryElapsedTime\"\:\"(?<queryelapsedtime>\d+)\"" | search queryelapsedtime > 99 | stats count, values(queryelapsedtime) by _time

Regards

0 Karma

akash_akkis
New Member

Hi gluente Thanks for your answer its working fine now I need the above sample which is edited Please give me some trick

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...