Splunk Search

How to write splunk Query to find all the occurrences of a Boolean key value pair in logs over a period of time

RemyaT
Engager

Given below is a snippet of splunk event. My requirement is to find all the occurrences of "isOutstanding": true. Here the point to note is that one event may/may not have multiple occurrences. Need to find the total count from multiple events over a period of time.

{
  \"school\": {
    \"schoolId\": \"1\",
    \"schoolName\": \"SchoolX\",
    \"schoolType\": \"private\",
    \"students\": [
      {
        \"id\": \"1\",
        \"isOutstanding\": true,
        
      },
      {
        \"id\": \"2\",
        \"isOutstanding\": false,
        
      },
      {
        \"id\": \"3\",
        \"isOutstanding\": false,
        
      }
    ]
  }
}

The below Splunk query index=myIndex "isOutstanding":true gives the count of events having "isOutstanding": true. But it doesn't consider the count of multiple occurrences in one event. How can I get the count of all the occourences in an event? TIA

 

Labels (6)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Depending on whether your actual event has the backslashes, try this

| rex max_match=0 "(?<isOutstanding>isOutstanding\\\\\":\s+true)"
| eval count = mvcount(isOutstanding)
| stats sum(count) as total

RemyaT
Engager

This was helpful but didn't exactly serve my requirement. Has to change a little bit for the final working query

| rex max_match=0 "(?<isOutstanding>isOutstanding\\\\\":true)"
|  stats count(isOutstanding) as total

 

richgalloway
SplunkTrust
SplunkTrust

Use rex to extract the 'isOutstanding' texts and mvcount to count them.

| rex max_match=0 "(?<isOutstanding>isOutstanding)"
| eval count = mvcount(isOutstanding)
---
If this reply helps you, an upvote would be appreciated.
0 Karma

PickleRick
Ultra Champion

@richgalloway @ITWhisperer If I remember correctly, simple stats count over a single field takes into account mvfields.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...