Splunk Search

How to filter a field from the log where the values change

Rajpranar
Explorer

How to filter a field from the log where the values change for example please see below,

logfile =(result1=0 result2=5 result3=10 result4=14)  at 5AM

logfile =(result1=8 result2=5 result3=10 result4=14) at 5:10Am

logfile =(result1=4 result2=5 result3=10 result4=14) at 5:20Am

logfile =(result1=3 result2=5 result3=10 result4=14) at 5:30Am

i want query to return result and show when result1 is greater than 5, please help

Current state im at =index=indexname | search sourcetype=eventname "result1=5" gives results but if i do
index=indexname | search sourcetype=eventname "result1> 5" returns nothing

 

0 Karma
1 Solution

marnall
Motivator

I recommend using the "where" command:

index=indexname sourcetype=eventname
| where result1 > 5



(note this assumes that result1 is already an extracted field. If not, try this:

index=indexname sourcetype=eventname
| rex field=_raw "result1=(?<result1>\d*)"
| where result1 > 5

View solution in original post

Rajpranar
Explorer

Thanks @marnall this worked perfectly.

0 Karma

marnall
Motivator

I recommend using the "where" command:

index=indexname sourcetype=eventname
| where result1 > 5



(note this assumes that result1 is already an extracted field. If not, try this:

index=indexname sourcetype=eventname
| rex field=_raw "result1=(?<result1>\d*)"
| where result1 > 5
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...