Splunk Search

How to write splunk Query to find all the occurrences of a Boolean key value pair in logs over a period of time

RemyaT
Explorer

Given below is a snippet of splunk event. My requirement is to find all the occurrences of "isOutstanding": true. Here the point to note is that one event may/may not have multiple occurrences. Need to find the total count from multiple events over a period of time.

{
  \"school\": {
    \"schoolId\": \"1\",
    \"schoolName\": \"SchoolX\",
    \"schoolType\": \"private\",
    \"students\": [
      {
        \"id\": \"1\",
        \"isOutstanding\": true,
        
      },
      {
        \"id\": \"2\",
        \"isOutstanding\": false,
        
      },
      {
        \"id\": \"3\",
        \"isOutstanding\": false,
        
      }
    ]
  }
}

The below Splunk query index=myIndex "isOutstanding":true gives the count of events having "isOutstanding": true. But it doesn't consider the count of multiple occurrences in one event. How can I get the count of all the occourences in an event? TIA

 

Labels (6)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Depending on whether your actual event has the backslashes, try this

| rex max_match=0 "(?<isOutstanding>isOutstanding\\\\\":\s+true)"
| eval count = mvcount(isOutstanding)
| stats sum(count) as total

RemyaT
Explorer

This was helpful but didn't exactly serve my requirement. Has to change a little bit for the final working query

| rex max_match=0 "(?<isOutstanding>isOutstanding\\\\\":true)"
|  stats count(isOutstanding) as total

 

richgalloway
SplunkTrust
SplunkTrust

Use rex to extract the 'isOutstanding' texts and mvcount to count them.

| rex max_match=0 "(?<isOutstanding>isOutstanding)"
| eval count = mvcount(isOutstanding)
---
If this reply helps you, Karma would be appreciated.
0 Karma

PickleRick
SplunkTrust
SplunkTrust

@richgalloway @ITWhisperer If I remember correctly, simple stats count over a single field takes into account mvfields.

Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...