I'm sorry I didn't see your reply sooner, thank you so much! You're a hero!! ... View more

Excellent! Is there a way of doing this directly with SPL? ... View more

Hello!! THanks for your answer! You are indeed correct! The event has some level that is treated as a Json, but nested in the "log" variable, the "stdout" variable has another dictionary within it that is being treated as a string, making it difficult to be worked with SPL. I did my research and it seems this might be an issue with the way the data is being parsed before arriving to splunk, before checking that I guess I'm stuck with searching for string literals 💔 Thank you for your time and help!! ... View more

I see... Well it seems like spath (and spl functionality in general) is working fine with the events, except for the contents in stdout... I spoke with an acquaintance and it looks like it's most likely due to the way the data is parsed before arriving to splunk. I can't thank you enough for your time and effort helping me!! It looks like this has to be checked outside of splunk tho, I'll close the ticket and come back with updates if I'm able to find a solution. ... View more

I see, I tried with different variables but _raw seems to hold all vital data in all cases, mabe I'm not doing something right, perhaps the part that is not in json format is the output inside the "stdout" variable.   EDIT: Here's the event in log format   { [-] cluster_id: cluster_id kubernetes: { [+] } log: { [-] caller: caller_here dc: dc_here flow: flow_here host: gatling_worker_here jobId: jobid_here level: info projectName: project_name_here stdout: { "Componente" : "componente_here", "channel" : "channel_here", "timestamp" : "timestamp_here", "Code" : "code_here", "logId" : "logid_here", "service" : "service_here", "responseMessage" : "responsemessage_here", "flow" : "flow_here", "log" : "log_here"} } time: time_here }   stdout is the issue it seems ... View more

I see,  should I copy and paste the event data into the search bar to do as the example you provided? Edit: I used: index="my_index" "log_id_here" logid responseMessage | spath input=data | transpose Strangely most if not all vital data was stored inside _raw as a single str ... View more

Hello!! Thank you for your response! And I'm sorry I explained myself so poorly! spath does not work: What I meant with this was, having the previous event string as an example, I am unable to use SPL queries such as index="my_index" logid="log_id_here" service="service_here" responseMessage="response_message_here" instead I gotta use index="my_index" "log_id_here" "service_here" "response_message_here" or index="my_index" "log_id_here" service logid responseMessage This is because no data is found when using "variables" such as  responseMessage="response_message_here" Instead I must search for specific string fragments within the event outputs... This is because the output is formatted as string instead of json making the SPL query creation a real pain.   What is your query: One example would be to individually get each responseMessage as such:  index="my_index" "log_id_here" logid service responseMessage \\\"responseMessage\\\" : \\\"null\\\" Instead of the normal way which would be index="my_index" logid="log_id_here" service responseMessage | stats count by responseMessage | dedup responseMessage   What results do I expect: Currently I'm trying to get unique services and order them desc based on the error count for each (which is based on the responseMessage) What results do I get: Currently I'm able to get the count of each service by using string literals such as \\\"service\\\" :  \\\"desk\\\" , other than that I'm stuck here. (I'm guessing this could  be done with something like  index="my_index" "logid" | stats count by service, responseMessage | eval isError=if(responseMessage!="success",1 ,0) | stats sum(isError) as errorCount by service I apologize in advance in case I've missed once again important details or if i've given wrong queries, I haven't been able to try them out as the documentation shows :C thank you very much for your time!! ... View more