How to write a search to extract these field values from my sample data without mismatch and export to CSV?

[sathishsathiyam]

Below is my applogs data:

{"name":"blink-api-manager","submodule":"perfLogger","level":30,"req":{"url":"/api/accounts/transfers/retrieveAccounts","method":"GET","uuid":"ciqki748r0ur3tvmx6nlh7k3s"},"APIResponseTime":{"AccountsView.findByCustomerId":{"api":892.391628}},"OverallResponseTime":894.698927,"msg":"","time":"2016-07-13T06:26:24.069Z","v":0} 

I have more than 20K data and need to filter 4 values: URL - APIResponseTime - OverallResponseTime - Time orderwise and need to download it in a CSV format. How it can be done?

[somesoni2 · Accepted solution]

Run following search and export result as csv

Your base search | rename req.* as * | table url APIResponseTime OVerallResponseTime time 

See this for export method
http://docs.splunk.com/Documentation/Splunk/6.4.1/Search/Exportsearchresults#Export_data_using_Splun...

[sathishsathiyam]

Thanks for the info, it just worked with table command itself.

[sundareshr]

May need spath before rename?

[somesoni2]

The data looks like a valid JSON , if the sourcetype is configured correctly then the JSON should be parsed correctly with fields already available. But you're correct if that's not the case. Sathish to confirm how his logs are setup/looking in Splunk.

[sathishsathiyam]

Yes its a valid JSON and since fields were already available, splunk parsed it correctly