Splunk Search

Splunk Search Query Help

newBie001
Loves-to-Learn

Hello All,

Could you please suggest to me whether this option is good or is there any optimized search query?

 query ---
index="XXX1" source="XXXX11" jsonbodyfield1=abc | search "jsonbodyfield2"=XXXX1 AND "jsonbodyfield3"=XXXX2 AND "jsonbodyfield3"="XXXX" AND jsonbodyfield4="XXX2" | stats count as Total

The user will have drop down option to select "jsonbodyfield1" and "jsonbodyfield4" from the available values.

Now this one field "jsonbodyfield4" is added new to the logs structure and since this is in AND condition so now the query shows the total count of records where this field is present (irrespective of its value). 

However, whenever the default value (*) of "jsonbodyfield4" is chosen from the dropdown then i want to show all records where the field is present (in the new logs) and the field was not present (in the old logs).

I was thinking to use multi-search query and having the where condition as (NOT jsonbodyfield4="*").
This might not work or may be not a good approach so could anyone please suggest?

Thanks.

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The values in the dropdown for jsonbodyfield4 could include the full clause e.g. AND jsonbodyfield4="XXX2" and when the label is * you set the value to an empty string, then you include the token in the search string e.g. ... AND "jsonbodyfield3"="$dropdowntoken3$" $dropdowntoken4$ | stats count as Total

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...