Hi
I have the following data (Below).
I have a situation where I want to search for "*" on a search and have it return all the data. resourceSpans{}.scopeSpans{}.spans{}.attributes{}.value.stringValue = "*"
However, this works for 99.9 % of my data, but the line below.
This path is not there. So when I run the command below, I get no results. However, I am looking for all data with the *. But as it's not there, it is excluding it. Is there any way I can still get the data back?
{"resourceSpans":[{"resource":{"attributes":[{"key":"process.pid","value":{"intValue":"600146"}},{"key":"service.instance.id","value":{"stringValue":"003nhhk3"}},{"key":"service.name","value":{"stringValue":"LAUNCHERMXMARKETRISK_MPC"}},{"key":"service.namespace","value":{"stringValue":"LAUNCHER"}},{"key":"telemetry.sdk.language","value":{"stringValue":"java"}},{"key":"telemetry.sdk.name","value":{"stringValue":"opentelemetry"}},{"key":"telemetry.sdk.version","value":{"stringValue":"1.34.0"}},{"key":"mx.env","value":{"stringValue":"dell945srv:13003"}}]},"scopeSpans":[{"scope":{"name":"mx-traces-api","version":"1.0.0"},"spans":[{"traceId":"10731f4b1d19380ceb33ae33672dbd5f","spanId":"cbf88ed07b403b48","parentSpanId":"3cfc7d85786b676b","name":"createSubmission","kind":1,"startTimeUnixNano":"1747152946314481406","endTimeUnixNano":"1747152946314775297","status":{}},{"traceId":"10731f4b1d19380ceb33ae33672dbd5f","spanId":"8ff7fabcab4b12d0","parentSpanId":"3cfc7d85786b676b","name":"createSubmission","kind":1,"startTimeUnixNano":"1747152946353054099","endTimeUnixNano":"1747152946353187644","status":{}},{"traceId":"10731f4b1d19380ceb33ae33672dbd5f","spanId":"4b14e49df1e1ffd8","parentSpanId":"3cfc7d85786b676b","name":"createSubmission","kind":1,"startTimeUnixNano":"1747152946474942393","endTimeUnixNano":"1747152946475042609","status":{}},{"traceId":"10731f4b1d19380ceb33ae33672dbd5f","spanId":"169b89bf118931d8","parentSpanId":"3cfc7d85786b676b","name":"createSubmission","kind":1,"startTimeUnixNano":"1747152946488875310","endTimeUnixNano":"1747152946488933120","status":{}}]}]}]}
Hi
Yes - this is correct.
resourceSpans{}.scopeSpans{}.spans{}.attributes{}.value.stringValue is the path that the token can change on.
The screenshot below shows me using it and getting back 34 events.
If I run it with =*, I get 225
If I run it without the filter, I get 294. So the issue is when I put in * I want to get 294, as there are other parts to the data that I need to look at.
Hi @livehybrid
Thanks for looking into this - cheers.
The issue is that I have filters (drop-downs) that I am using to zoom into data.
So when I pick a jobID it works very well for other tables
For example. The table below would have a filter
The code would look like this. So this is perfect for "CONSO_ABAQ | 31/03/2016 | 22".
However, if I put in * from the drop-down. I won't get the original line as it does not have resourceSpans{}.scopeSpans{}.spans{}.attributes{}.value.stringValue - however, I am looking to extract other data from that line to complete the table.
host="MARKET_RISK_PDT_V2" index="murex_logs" sourcetype="Market_Risk_DT"
| search "resourceSpans{}.resource.attributes{}.value.stringValue"="*"
| search resourceSpans{}.scopeSpans{}.spans{}.attributes{}.value.stringValue = "CONSO_ABAQ | 31/03/2016 | 22"
| spath resourceSpans{}.scopeSpans{}.spans{} output=scopeSpans
| stats count by scopeSpans
| spath input=scopeSpans
| rename startTimeUnixNano as start
| rename endTimeUnixNano as end
| eval _time=start/pow(10,9)
| eval duration = end -start
| eval duration= duration/1000000
| eval duration = round(duration,0)
| eval parentSpanId =if(parentSpanId="" ,"0", $parentSpanId$)
| rename name as SPAN_TYPE
| search traceId = *
| search spanId="*" OR parentSpanId="*"
| stats avg(duration) as Average count(duration) AS count, stdev(duration) AS stdev, median(duration) AS median, exactperc75(duration) AS perc75, exactperc95(duration) AS perc95, exactperc99.5(duration) AS perc99.5, min(duration) AS min, max(duration) AS max by SPAN_TYPE
| sort - Average
I see, okay - in that case I think the below might work for you? This works by setting the fieldName into the value so you dont need something=$token$ you just do $token$ as it already contains something= within it:
All:
<form version="1.1">
<label>Demo</label>
<fieldset submitButton="false">
<input type="dropdown" token="testToken" searchWhenChanged="true">
<label>Test. Token</label>
<choice value="*">All</choice>
<choice value=""resourceSpans{}.resource.attributes{}.value.stringValue"="CONSO_ABAQ | 31/03/2016 | 23"">CONSO_ABAQ | 31/03/2016 | 23 (Static)</choice>
<fieldForLabel>obj</fieldForLabel>
<fieldForValue>option</fieldForValue>
<search>
<query>| makeresults | eval obj="CONSO_ABAQ | 31/03/2016 | 22"
| eval option="\"resourceSpans{}.resource.attributes{}.value.stringValue\"=\"".obj."\""</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>|makeresults | eval _raw=json_set("{}","resourceSpans{}.resource.name.stringValue","Testing")
|append [makeresults | eval _raw=json_set("{}","resourceSpans{}.resource.attributes{}.value.stringValue","CONSO_ABAQ | 31/03/2016 | 22")] |spath|search $testToken$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>🌟 Did this answer help you? If so, please consider:
- Adding karma to show it was useful
- Marking it as the solution if it resolved your issue
- Commenting if you need any clarification
Your feedback encourages the volunteers in this community to continue contributing
