Splunk Search

How to write a search to extract these field values from my sample data without mismatch and export to CSV?

sathishsathiyam
New Member

Below is my applogs data:

{"name":"blink-api-manager","submodule":"perfLogger","level":30,"req":{"url":"/api/accounts/transfers/retrieveAccounts","method":"GET","uuid":"ciqki748r0ur3tvmx6nlh7k3s"},"APIResponseTime":{"AccountsView.findByCustomerId":{"api":892.391628}},"OverallResponseTime":894.698927,"msg":"","time":"2016-07-13T06:26:24.069Z","v":0} 

I have more than 20K data and need to filter 4 values: URL - APIResponseTime - OverallResponseTime - Time orderwise and need to download it in a CSV format. How it can be done?

0 Karma
1 Solution

somesoni2
Revered Legend

Run following search and export result as csv

Your base search | rename req.* as * | table url APIResponseTime OVerallResponseTime time 

See this for export method
http://docs.splunk.com/Documentation/Splunk/6.4.1/Search/Exportsearchresults#Export_data_using_Splun...

View solution in original post

0 Karma

somesoni2
Revered Legend

Run following search and export result as csv

Your base search | rename req.* as * | table url APIResponseTime OVerallResponseTime time 

See this for export method
http://docs.splunk.com/Documentation/Splunk/6.4.1/Search/Exportsearchresults#Export_data_using_Splun...

0 Karma

sathishsathiyam
New Member

Thanks for the info, it just worked with table command itself.

0 Karma

sundareshr
Legend

May need spath before rename?

0 Karma

somesoni2
Revered Legend

The data looks like a valid JSON , if the sourcetype is configured correctly then the JSON should be parsed correctly with fields already available. But you're correct if that's not the case. Sathish to confirm how his logs are setup/looking in Splunk.

0 Karma

sathishsathiyam
New Member

Yes its a valid JSON and since fields were already available, splunk parsed it correctly

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...