Hello there, I have the next JSON which would be my event: {"severity":"PROCESS","marker":"EML[ EMLMOD ]","logger":"SURALOGGER[PROCESS#EML#EMLMOD]","thread":"application-akka.actor.default-dispatcher-8","message":"TRANSACTIONID=dec-cf08c726-c229-46ed-9c4a-2a19b760f1c8|FECCOL=2019-04-08T14:00:07|COMENTARIO=null|DECLARACION={\"idDeclaracion\":\"dec-cf08c726-c229-46ed-9c4a-2a19b760f1c8\",\"idCotizacion\":\"cot004\",\"idSolicitud\":\"080008072325\",\"fecha\":1554317807,\"producto\":{\"ramo\":\"080\",\"subRamo\":\"vc2\"},\"canal\":\"020\",\"prospecto\":{\"id\":\"1111\",\"edad\":29,\"talla\":180,\"peso\":80,\"imc\":24.69,\"ocupacion\":\"A36\",\"sexo\":\"femenino\"},\"datosAdicionales\":null,\"preguntas\":[{\"id\":\"pe-38104e2d-28d0-49d1-ab80-37f8537cd3bc\",\"respuestas\":[{\"id\":\"re-3a8ba35c-e3d7-4eea-8d80-167ec5c213ea\",\"esPositiva\":false}]},{\"id\":\"pe-c67edfb6-f990-4bc4-ba9f-f6a2dca8b914\",\"respuestas\":[{\"id\":\"re-a315d1ab-f57f-41d0-96c3-ee4048504d5e\",\"esPositiva\":true},{\"id\":\"re-8251a993-595a-4f69-883b-fccf01748518\",\"esPositiva\":true}]},{\"id\":\"pe-9945cdf8-eb3d-4499-887b-40fe201e2c64\",\"respuestas\":[{\"id\":\"re-negativa-pregunta-otras-enfermedades\",\"esPositiva\":false}]},{\"id\":\"pe-19f3325e-f775-4abe-a8e1-218d1bb24cc6\",\"respuestas\":[{\"id\":\"re-negativa-pregunta-otros-deportes\",\"esPositiva\":false}]},{\"id\":\"pe-d0bdf8cd-bb79-4440-b171-0028ca1deb3a\",\"respuestas\":[{\"id\":\"re-1bb16e02-ec0a-4b36-8f5d-4cff953a70ae\",\"esPositiva\":false}]},{\"id\":\"pe-35d09af1-4ad4-46e9-bd76-e50f2afa5dcc\",\"respuestas\":[{\"id\":\"re-9e559f45-342c-4f7c-9a4d-1bf0daebaa5d\",\"esPositiva\":false}]},{\"id\":\"pe-3705c84b-2e55-4bb0-9c3c-1061b7814e8d\",\"respuestas\":[{\"id\":\"re-b4add8ef-ccae-49c3-a664-242bfa4a6875\",\"esPositiva\":true}]},{\"id\":\"pe-3b93e80e-d7d0-4d90-bf13-16489da2d47f\",\"respuestas\":[{\"id\":\"re-95f212a4-3562-405a-be24-aa656b93fe80\",\"esPositiva\":false}]}],\"decisiones\":{\"declinar\":{\"coberturas\":[\"vrd\",\"pau\",\"vgc\"],\"codigosCie\":[]},\"aprobar\":{\"coberturas\":[\"gex\",\"vcn\"],\"codigosCie\":[]},\"extraprimar-miles\":[{\"cobertura\":\"mac\",\"magnitud\":3,\"clasificacion\":\"deporte extremo\",\"codigosCie\":[\"Z57\"]},{\"cobertura\":\"vid\",\"magnitud\":3,\"clasificacion\":\"deporte extremo\",\"codigosCie\":[\"Z57\"]}],\"extraprimar-porcentaje\":[{\"cobertura\":\"ive\",\"magnitud\":25,\"clasificacion\":\"morbilidad\",\"codigosCie\":[\"I10X\"]},{\"cobertura\":\"ive\",\"magnitud\":100,\"clasificacion\":\"deporte extremo\",\"codigosCie\":[\"Z57\"]},{\"cobertura\":\"vid\",\"magnitud\":25,\"clasificacion\":\"morbilidad\",\"codigosCie\":[\"I10X\"]},{\"cobertura\":\"iva\",\"magnitud\":100,\"clasificacion\":\"deporte extremo\",\"codigosCie\":[\"Z57\"]},{\"cobertura\":\"efg\",\"magnitud\":25,\"clasificacion\":\"morbilidad\",\"codigosCie\":[\"I10X\"]},{\"cobertura\":\"efg\",\"magnitud\":50,\"clasificacion\":\"deporte extremo\",\"codigosCie\":[\"Z57\"]}],\"riesgo-sub-normal\":[\"E780\",\"I10X\"]}}"} I want to count the events which has the path 'decisiones.declinar' defined. This is my query: index=eml | rex field=message "DECLARACION=(?<declaracion>[\"\s\W\{\}\[\]:\w\n\.]+)" | where NOT isnull(declaracion) | spath input=declaracion | eval declinar = if(isnull('decisiones.declinar'), 0, 1) | table declinar The problem is i always get 0 for each event, even though the path 'decisiones.declinar' is defined. Any suggestions? ... View more

Hey guys, I have the next query: index=idx_rtd_prc sourcetype=rbt_rtd_src_type TIPO_ENTIDAD=PROVISION_COMISION MONEDA=COP TIPO_MENSAJE=VALIDACION | eval x = [search index=idx_rtd_prc sourcetype=rbt_rtd_src_type TIPO_ENTIDAD=PROVISION_COMISION MONEDA=COP TIPO_MENSAJE=VALIDACION | rename RESULTADO_VALIDACION.PROVISION_COMISION.RESULTADO as RESULTADO, RESULTADO_VALIDACION.PROVISION_COMISION.SUMA_GW as SUMA_GW | dedup IDENTIFICADOR_ENTIDAD sortby +_time -FECHA_SAP | eval SUMA_DELTA_OK=if((RESULTADO=="OK"), SUMA_GW, 0) | eval SUMA_DELTA_ERROR=if((RESULTADO!="OK"), SUMA_GW, 0) | stats count as DELTA_PROVISION sum(SUMA_DELTA_OK) as SUMA_DELTA_OK sum(SUMA_DELTA_ERROR) as SUMA_DELTA_ERROR | eval result = ??? | return $result] | table x As you can see i have this two fields SUMA_DELTA_OK and SUMA_DELTA_ERROR, i need to return both of them as result of the subsearch so i avoid to make a subsearch for OK and ERROR. Any idea how to do this? returning a tuple, and array or something? Also how do i extract them after that. Thanks! ... View more

Hello everybody, I have the next event registered in my splunk: Fri Mar 31 11:05:18 COT 2017 name=amqp_msg_received event_id=null msg_queue=seguros.traza.documentoValidado msg_exchange=seguros.cuadre.documentoValidado msg_body={"valid": true} And what i need is to extract the value of "valid", the source_type of the event is json_no_timestamp, how could i do this? I have tried using spath without luck, any advice? Thanks. ... View more