Splunk Search

Splunk Query when attribute having dot seperator

rahulmittal2391
New Member

rahulmittal2391_0-1716474280043.png

not able to search with any attribute which are having .(dot) like env.cookieSize

NOT WORKING

------------------

 

index="ss-prd-dkp" "*price?sailingId=IC20240810&currencyIso=USD&categoryId=pt_internet" | spath status | search status=500 | spath "context.duration" | search "context.duration"="428.70000000006985"| spath "context.env.cookiesSize" | search "context.env.cookiesSize"=7670

 

WORKING

 

index="ss-prd-dkp" "*price?sailingId=IC20240810&currencyIso=USD&categoryId=pt_internet" | spath status | search status=500 | spath "context.duration" | search "context.duration"="428.70000000006985"

 

Let me know the solution for this 

context: { [-]
     duration: 428.70000000006985
     env.automation-bot: false
     env.cookiesSize: 7670
     env.laneColor: blue

}
Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Use single quote to protect field names when there is some undesirable side effects from flattened JSON path. (search command cannot finesse this, unfortunately.)

index="ss-prd-dkp" "*price?sailingId=IC20240810&currencyIso=USD&categoryId=pt_internet"
| where status=500 AND 'context.duration' == 428.70000000006985
 AND 'context.env.cookiesSize' == 7670

But note:

  • Please use raw text format when sharing structured data.
  • Those spath commands are not necessary.
Tags (1)
0 Karma

rahulmittal2391
New Member

how we can filter it with providing the value 7670

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try using the json_extract_exact function (which doesn't use paths and therefore avoids the issue of keys looking like paths.

| spath context
| eval cookiesSize=json_extract_exact(context, "env.cookiesSize")
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...