Splunk Search

Sub Search for Spath or rex commands



I am trying to use sub search to extract fields from my JSON logs. I tried with spath and also with Rex  commands, I ended up with the below error:


Error in 'rex' command: Invalid argument: '(' 


Here is the sample log form on of the events:


{"dimension": {"id": 637545304780000000, "name": "2021-04-20T15:47:58Z"}, "end": "2021-04-20T15:48:29.5067304Z", "host_Ip": "", "indicators": {"First Contentful Paint": "None", "First Paint": "None", "Jitter [ms]": "None", "Max jitter": "None", "Max packet lost": "None", "Max round trip time": "None", "Min Packet loss": "None", "Min jitter": "None", "Min round trip time": "None", "TTInteractive": "None", "appium_errors_#": "None", "appium_test_time_ms": "None", "bytes received": "None", "bytes sent": "None", "custom": "None", "email response time": "None", "email round trip time": "None", "ipfs availabilty count": "None", "ipfs download": "None", "ipfs ping": "None", "ipfs upload": "None", "ipfs upload file size": "None", "lighthouse2": "None", "loader": "None", "rakesh_testing_indicator": "None"}, "node_id": 11, "node_name": "New York, US - Level3", "start": "2021-04-20T15:33:29.5067304Z", "step": "1", "step_name": "1 Login username", "synthetic_metrics": {"# Connection Failures": "None", "# Connections": "8.0", "# Content Load Errors": "0.0", "# Css": "1.0", "# DNS Failures": "None", "# Flash": "0.0", "# Font": "1.0", "# Hosts": "7.0", "# Html": "2.0", "# Image": "2.0", "# Items (Total)": "17.0", "# JS Errors per Page": "0.0", "# Media": "0.0", "# Other": "0.0", "# Purged Runs": "None", "# Redirect": "2.0", "# Response Failures": "None", "# Runs": "1.0", "# SSL Failures": "None", "# Script": "10.0", "# Test Errors": "None", "# Tests with JS Errors": "None", "# Timeout Failures": "None", "# Xml": "0.0", "# Zones": "1.0", "% Adjusted Availability": "100.0", "% Availability": "100.0", "% Content Availability": "100.0", "% Downtime": "0.0", "% Frustrated": "0.0", "% Not Frustrated": "100.0", "% Ping Packet Loss": "None", "% Satisfied": "100.0", "% Self Bottleneck": "None", "% Step Content Availability": "None", "% Third Party Bottleneck": "None", "% Tolerating": "0.0", "Apdex": "1.0", "Client Time (ms)": "64.0", "Connect (ms)": "17.0", "Content Load (ms)": "3952.0", "Css (ms)": "36.0", "Css Bytes": "1086.0", "DNS (ms)": "13.0", "DOM Load (ms)": "1168.0", "Document Complete (ms)": "1322.0", "Downloaded Bytes": "2744.0", "File Size": "476.0", "First Contentful Paint": "1751.0", "First Paint": "1751.0", "Flash (ms)": "None", "Flash Bytes": "None", "Font (ms)": "17.0", "Font Bytes": "16267.0", "Frames Per Second": "23.1000003815", "Html (ms)": "502.0", "Html Bytes": "4396.0", "Image (ms)": "93.0", "Image Bytes": "8590.0", "Load (ms)": "None", "Media (ms)": "None", "Media Bytes": "None", "Other (ms)": "None", "Other Bytes": "None", "Page Speed Score": "None", "Ping Round Trip (ms)": "None", "Redirect (ms)": "359.0", "Render Start (ms)": "1796.0", "Response (ms)": "447.0", "SSL (ms)": "22.0", "Script (ms)": "3221.0", "Script Bytes": "1152629.0", "Self Downloaded Bytes": "None", "Send (ms)": "1.0", "Server Response (ms)": "434.0", "Signal Quality": "None", "Signal Strength (dBm)": "None", "Speed Index": "2021.0", "Test Time (ms)": "4309.0", "Throughput": "6.96446700508", "Time To First Byte (ms)": "447.0", "Time To Interactive": "4076.0", "Time to Title (ms)": "None", "Total Downloaded Bytes": "1182968.0", "Visually Complete (ms)": "1751.0", "Wait (ms)": "394.0", "Webpage Response (ms)": "4309.0", "Webpage Throughput": "274.53423068", "Wire Time (ms)": "1258.0", "Xml (ms)": "None", "Xml Bytes": "None"}, "test_id": 1215995, "test_name": "One Login Google authenticator"}


Can someone help me with how to use sub search with Spath or rex commands?
Basically, both the primary and sub queries will be using the Spath or rex command to extract few values from the above JSON.

A basic example will be good enough for me to try.splunk.png


Labels (1)
0 Karma


Thanks for that!

However, I was looking to use that with sub search.
For both the primary and sub queries, I would need to use spath.

0 Karma

| spath path=indicators.TTInteractive output=TTInteractive
| spath path=synthetic_metrics output=synthetic_metrics
| spath input=synthetic_metrics

| rex "First Contentful Paint\": \"(?<firstContentfulPaint>[^\"]+)"
0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...