Splunk Search

How to generate a regex to find text and values greater than or equal to 2000001?

kalais
New Member

Hi ,
I have in my log like
{"name":"liquid-networth","value":"2000001"}

I need to get all value which is greater than and equal to 2000001. Please help me to find in splunk search..

0 Karma

woodcock
Esteemed Legend

Like this:

index=YourIndexHere sourcetype=YourSourcetypeHere | spath | search value >= 2000001

Note: the spath command might create a field name with other prefices for value so it may not have that exact name.

0 Karma

micahkemp
Champion

You can use >= in your search, assuming you have "value" parsed out into a field already:

index=(your index) value >= 2000001
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...