Splunk Search

Sub Search for Spath or rex commands



I am trying to use sub search to extract fields from my JSON logs. I tried with spath and also with Rex  commands, I ended up with the below error:


Error in 'rex' command: Invalid argument: '(' 


Here is the sample log form on of the events:


{"dimension": {"id": 637545304780000000, "name": "2021-04-20T15:47:58Z"}, "end": "2021-04-20T15:48:29.5067304Z", "host_Ip": "", "indicators": {"First Contentful Paint": "None", "First Paint": "None", "Jitter [ms]": "None", "Max jitter": "None", "Max packet lost": "None", "Max round trip time": "None", "Min Packet loss": "None", "Min jitter": "None", "Min round trip time": "None", "TTInteractive": "None", "appium_errors_#": "None", "appium_test_time_ms": "None", "bytes received": "None", "bytes sent": "None", "custom": "None", "email response time": "None", "email round trip time": "None", "ipfs availabilty count": "None", "ipfs download": "None", "ipfs ping": "None", "ipfs upload": "None", "ipfs upload file size": "None", "lighthouse2": "None", "loader": "None", "rakesh_testing_indicator": "None"}, "node_id": 11, "node_name": "New York, US - Level3", "start": "2021-04-20T15:33:29.5067304Z", "step": "1", "step_name": "1 Login username", "synthetic_metrics": {"# Connection Failures": "None", "# Connections": "8.0", "# Content Load Errors": "0.0", "# Css": "1.0", "# DNS Failures": "None", "# Flash": "0.0", "# Font": "1.0", "# Hosts": "7.0", "# Html": "2.0", "# Image": "2.0", "# Items (Total)": "17.0", "# JS Errors per Page": "0.0", "# Media": "0.0", "# Other": "0.0", "# Purged Runs": "None", "# Redirect": "2.0", "# Response Failures": "None", "# Runs": "1.0", "# SSL Failures": "None", "# Script": "10.0", "# Test Errors": "None", "# Tests with JS Errors": "None", "# Timeout Failures": "None", "# Xml": "0.0", "# Zones": "1.0", "% Adjusted Availability": "100.0", "% Availability": "100.0", "% Content Availability": "100.0", "% Downtime": "0.0", "% Frustrated": "0.0", "% Not Frustrated": "100.0", "% Ping Packet Loss": "None", "% Satisfied": "100.0", "% Self Bottleneck": "None", "% Step Content Availability": "None", "% Third Party Bottleneck": "None", "% Tolerating": "0.0", "Apdex": "1.0", "Client Time (ms)": "64.0", "Connect (ms)": "17.0", "Content Load (ms)": "3952.0", "Css (ms)": "36.0", "Css Bytes": "1086.0", "DNS (ms)": "13.0", "DOM Load (ms)": "1168.0", "Document Complete (ms)": "1322.0", "Downloaded Bytes": "2744.0", "File Size": "476.0", "First Contentful Paint": "1751.0", "First Paint": "1751.0", "Flash (ms)": "None", "Flash Bytes": "None", "Font (ms)": "17.0", "Font Bytes": "16267.0", "Frames Per Second": "23.1000003815", "Html (ms)": "502.0", "Html Bytes": "4396.0", "Image (ms)": "93.0", "Image Bytes": "8590.0", "Load (ms)": "None", "Media (ms)": "None", "Media Bytes": "None", "Other (ms)": "None", "Other Bytes": "None", "Page Speed Score": "None", "Ping Round Trip (ms)": "None", "Redirect (ms)": "359.0", "Render Start (ms)": "1796.0", "Response (ms)": "447.0", "SSL (ms)": "22.0", "Script (ms)": "3221.0", "Script Bytes": "1152629.0", "Self Downloaded Bytes": "None", "Send (ms)": "1.0", "Server Response (ms)": "434.0", "Signal Quality": "None", "Signal Strength (dBm)": "None", "Speed Index": "2021.0", "Test Time (ms)": "4309.0", "Throughput": "6.96446700508", "Time To First Byte (ms)": "447.0", "Time To Interactive": "4076.0", "Time to Title (ms)": "None", "Total Downloaded Bytes": "1182968.0", "Visually Complete (ms)": "1751.0", "Wait (ms)": "394.0", "Webpage Response (ms)": "4309.0", "Webpage Throughput": "274.53423068", "Wire Time (ms)": "1258.0", "Xml (ms)": "None", "Xml Bytes": "None"}, "test_id": 1215995, "test_name": "One Login Google authenticator"}


Can someone help me with how to use sub search with Spath or rex commands?
Basically, both the primary and sub queries will be using the Spath or rex command to extract few values from the above JSON.

A basic example will be good enough for me to try.splunk.png


Labels (1)
0 Karma


Thanks for that!

However, I was looking to use that with sub search.
For both the primary and sub queries, I would need to use spath.

0 Karma

| spath path=indicators.TTInteractive output=TTInteractive
| spath path=synthetic_metrics output=synthetic_metrics
| spath input=synthetic_metrics

| rex "First Contentful Paint\": \"(?<firstContentfulPaint>[^\"]+)"
0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...