Given a query   | mstats sum(ktm.lag_ms_count) as sum_count where index=ktm   I want to restrict the results based on another attribute like this   | mstats sum(ktm.lag_ms_count) as sum_count where index=ktm,ktm.lag_ms_mean > 120000   But this doesn't work. Possible to do this kind of filter in mstats? I've been able to do absolute filters   where index=ktm,cluster=app   But the ranged thing doesn't work ... View more

Using the Splunk addon for AWS to collect ec2 instance metadata I get an array called tags with key/value pairs such as below. What I want to do is extract the cluster name as a distinct var so that I can search on it or even better aggregate on it. Thoughts?        { [-]        Key: hostname        Value: elasticsearch001      }      { [-]        Key: cluster        Value: systemlogs ... View more