Splunk Search

Splunk Query when attribute having dot seperator

rahulmittal2391
New Member

rahulmittal2391_0-1716474280043.png

not able to search with any attribute which are having .(dot) like env.cookieSize

NOT WORKING

------------------

 

index="ss-prd-dkp" "*price?sailingId=IC20240810&currencyIso=USD&categoryId=pt_internet" | spath status | search status=500 | spath "context.duration" | search "context.duration"="428.70000000006985"| spath "context.env.cookiesSize" | search "context.env.cookiesSize"=7670

 

WORKING

 

index="ss-prd-dkp" "*price?sailingId=IC20240810&currencyIso=USD&categoryId=pt_internet" | spath status | search status=500 | spath "context.duration" | search "context.duration"="428.70000000006985"

 

Let me know the solution for this 

context: { [-]
     duration: 428.70000000006985
     env.automation-bot: false
     env.cookiesSize: 7670
     env.laneColor: blue

}
Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Use single quote to protect field names when there is some undesirable side effects from flattened JSON path. (search command cannot finesse this, unfortunately.)

index="ss-prd-dkp" "*price?sailingId=IC20240810&currencyIso=USD&categoryId=pt_internet"
| where status=500 AND 'context.duration' == 428.70000000006985
 AND 'context.env.cookiesSize' == 7670

But note:

  • Please use raw text format when sharing structured data.
  • Those spath commands are not necessary.
Tags (1)
0 Karma

rahulmittal2391
New Member

how we can filter it with providing the value 7670

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try using the json_extract_exact function (which doesn't use paths and therefore avoids the issue of keys looking like paths.

| spath context
| eval cookiesSize=json_extract_exact(context, "env.cookiesSize")
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...