Splunk Search

Search within dynamic list of items

splkuser20
Loves-to-Learn

I have an item to search withing logs with the schema similar to one below.  It is kind of searching for certain uri and status within a dynamic list of items.. item_1, item_2, item_N

log": {
"type": "web""datetime": "xxxxx"

"data": {
"item_1": {
"httpstatus": "200",
"path": "/pr/s1"
},
"item_2":  {
"httpstatus": "200",
"path": "/pr/s2"
}
}
}

I am kind of wondering how to make Item_*  search with a regex. So , in this case it's the field name which would need regex.  Any pointers on where to start

Labels (4)
Tags (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

if the event you posted is json, then it should be parsed automatically.

do you want to extract item_1=value and item_2=value and so on?

————————————
If this helps, give a like below.
0 Karma

splkuser20
Loves-to-Learn

so.. in query/search , the value of the item would be used as a parameter, and result shoud only show ones matching

say searching for a value within all item_*, ones that match should show up.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...