Splunk Search

using greater than comparison on a property is not working

47024
New Member

I am trying to filter my results on a property that is greater than a certain value and it is not returning any results. If I do an equals to comparison it works. Below is my filter criteria and the property outline.

Query:
index="lab" source="*-test" | eval isGood=if('line.message.space-document.elements{}.y'>="1664","true","false") | where isGood="true" | stats count

Below is the format of the event i'm trying to capture:
line: { [-]
message: { [-]
space-document: { [-]
elements: [ [-]
{ [-]
x: 38
y: 1664
}
{ [-]
id: ac5q3ghn
x: 38
y: 708
}
]
}
}
}

Tags (1)
0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw ="{\"line\": { \"message\": { \"space-document\": { \"elements\": [ { \"x\": 38, \"y\": 1664 }, { \"id\": \"ac5q3ghn\", \"x\": 38, \"y\": 708 } ] } } } }"
| spath

for this result, y is multivalue.

| makeresults 
| eval _raw ="{\"line\": { \"message\": { \"space-document\": { \"elements\": [ { \"x\": 38, \"y\": 1664 }, { \"id\": \"ac5q3ghn\", \"x\": 38, \"y\": 708 } ] } } } }"
| spath
| eval y='line.message.space-document.elements{}.y'
| eval count = mvcount(mvfilter(y>=1664))
| eventstats sum(count) as Total

If y is counted, it will look like this.

0 Karma

Sukisen1981
Champion

try this

index="lab" source="*-test" |rex field=_raw "y:(?<y>.*)"|eval isGood=if(y>=1664,"true","false")|..rest of your code
0 Karma

47024
New Member

Thank you for the suggestion, but it didn't seem to change the results...however not sure if I coded it correctly:
index="lab" source="-test" | rex field=_raw "y:(?.)" | eval isGood=if(y=1664,"true","false") | where isGood="true" | stats count

0 Karma

Sukisen1981
Champion

hi @47024
Remove all code after the rex, are you able to see the values of 'y' returned by the rex? index="lab" source="*-test" |rex field=_raw "y:(?<y>.*)|table y"

0 Karma

47024
New Member

This statement returns 2 :
index="lab" source="*-test" | eval y='line.message.space-document.design.elements{}.y' | where y="1664" | stats count

This statement returns 0:
index="lab" source="*-test" | eval y='line.message.space-document.design.elements{}.y' | where y>="1664" | stats count

0 Karma

47024
New Member

No I don't see any results other than just 'y'. For context...I can use > comparison for properties out of one of the other groups...but the elements group is where it is having the problem. I was curious if it was because there can be 1-x elements per event?

https://docs.google.com/drawings/d/16qy44bgdiODiJTFmS7qqicVdvsOYtax57VZ00QKaFks/edit?usp=sharing

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...