Seach query

[klausJohan]

Hello,

My scripted input is configured to poll a particular resource and index into an event the JSON object that it receives as response. The JSON object is of the form :

{ 
  json_response:
   {
        "resource_name": "rName",
        "statistic_1": "value_1",
        "statistic_2": "value_2",
         ..............
        "statistic_n": "value_n"
   }
}

The script can be configured to poll different resources and therefore I have indexed many such responses objectss potential corresponding to different resources.

I would need some help in parametrizeze the search query so that I can visualize statistics coresponding to only a particular resource .

Currently I'm using somethin like :

source="MyScript" | timechart span=1m avg(json_response.statistic_1) as statistic_1

, but this takes everything into consideration and I want that only those events (Json objects) that are relevant for a particular resource to be taken into consideration when plotting the series

something like :

source="MyScript" | json_response.resource_name = "a_resource"| timechart span=1m avg(json_response.statistic_1) as statistic_1

Thanks

[grijhwani · Accepted solution]

Try it without the first pipe. All clauses after the first take the form "command parameters...", but your initial search can have compound conditions.