Splunk Search

Seach query

klausJohan
Path Finder

Hello,

My scripted input is configured to poll a particular resource and index into an event the JSON object that it receives as response. The JSON object is of the form :

{ 
  json_response:
   {
        "resource_name": "rName",
        "statistic_1": "value_1",
        "statistic_2": "value_2",
         ..............
        "statistic_n": "value_n"
   }
}

The script can be configured to poll different resources and therefore I have indexed many such responses objectss potential corresponding to different resources.

I would need some help in parametrizeze the search query so that I can visualize statistics coresponding to only a particular resource .

Currently I'm using somethin like :

source="MyScript" | timechart span=1m avg(json_response.statistic_1) as statistic_1

, but this takes everything into consideration and I want that only those events (Json objects) that are relevant for a particular resource to be taken into consideration when plotting the series

something like :

source="MyScript" | json_response.resource_name = "a_resource"| timechart span=1m avg(json_response.statistic_1) as statistic_1

Thanks

0 Karma
1 Solution

grijhwani
Motivator

Try it without the first pipe. All clauses after the first take the form "command parameters...", but your initial search can have compound conditions.

View solution in original post

grijhwani
Motivator

Try it without the first pipe. All clauses after the first take the form "command parameters...", but your initial search can have compound conditions.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...