Splunk Search

How to write a search to extract these field values from my sample data without mismatch and export to CSV?

sathishsathiyam
New Member

Below is my applogs data:

{"name":"blink-api-manager","submodule":"perfLogger","level":30,"req":{"url":"/api/accounts/transfers/retrieveAccounts","method":"GET","uuid":"ciqki748r0ur3tvmx6nlh7k3s"},"APIResponseTime":{"AccountsView.findByCustomerId":{"api":892.391628}},"OverallResponseTime":894.698927,"msg":"","time":"2016-07-13T06:26:24.069Z","v":0} 

I have more than 20K data and need to filter 4 values: URL - APIResponseTime - OverallResponseTime - Time orderwise and need to download it in a CSV format. How it can be done?

0 Karma
1 Solution

somesoni2
Revered Legend

Run following search and export result as csv

Your base search | rename req.* as * | table url APIResponseTime OVerallResponseTime time 

See this for export method
http://docs.splunk.com/Documentation/Splunk/6.4.1/Search/Exportsearchresults#Export_data_using_Splun...

View solution in original post

0 Karma

somesoni2
Revered Legend

Run following search and export result as csv

Your base search | rename req.* as * | table url APIResponseTime OVerallResponseTime time 

See this for export method
http://docs.splunk.com/Documentation/Splunk/6.4.1/Search/Exportsearchresults#Export_data_using_Splun...

0 Karma

sathishsathiyam
New Member

Thanks for the info, it just worked with table command itself.

0 Karma

sundareshr
Legend

May need spath before rename?

0 Karma

somesoni2
Revered Legend

The data looks like a valid JSON , if the sourcetype is configured correctly then the JSON should be parsed correctly with fields already available. But you're correct if that's not the case. Sathish to confirm how his logs are setup/looking in Splunk.

0 Karma

sathishsathiyam
New Member

Yes its a valid JSON and since fields were already available, splunk parsed it correctly

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...