Splunk Search

Search within dynamic list of items

splkuser20
Loves-to-Learn

I have an item to search withing logs with the schema similar to one below.  It is kind of searching for certain uri and status within a dynamic list of items.. item_1, item_2, item_N

log": {
"type": "web""datetime": "xxxxx"

"data": {
"item_1": {
"httpstatus": "200",
"path": "/pr/s1"
},
"item_2":  {
"httpstatus": "200",
"path": "/pr/s2"
}
}
}

I am kind of wondering how to make Item_*  search with a regex. So , in this case it's the field name which would need regex.  Any pointers on where to start

Labels (4)
Tags (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

if the event you posted is json, then it should be parsed automatically.

do you want to extract item_1=value and item_2=value and so on?

————————————
If this helps, give a like below.
0 Karma

splkuser20
Loves-to-Learn

so.. in query/search , the value of the item would be used as a parameter, and result shoud only show ones matching

say searching for a value within all item_*, ones that match should show up.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...