Splunk Search

Unfamiliar Syntax in Query

inovexsean
Explorer

I have a query, written by someone else, that I'm trying to understand: tstats count as count sum(sessionLength) as volume where (index=accm_*) name="John",selectors{}.category{}=* by selectors{}.categories{}, |.... I can not find a reference anywhere for the selectors{}.category{}. Could someone please point me in the right direction? Thanks.

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

First of all are you getting output? query fails here itself at index-accm_* it should be index=accm_* can you paste entire query in 101010 sample code format.

View solution in original post

0 Karma

mayurr98
Super Champion

First of all are you getting output? query fails here itself at index-accm_* it should be index=accm_* can you paste entire query in 101010 sample code format.

0 Karma

inovexsean
Explorer

Sorry, that was a typo on my part. Due to sensitivity I cannot copy paste the entire query.

0 Karma

mayurr98
Super Champion

okay now it looks better so if you look the raw data in verbose mode that is type this search query index=accm_* name=* you should see a field name selectors{}.categories{}.

You are basically doing event count and sum of session length by categories(values in the selectors{}.categories{} field )

inovexsean
Explorer

Okay, so that's just some kind of internal field name that you only see when verbose mode is enabled. Thank you.

0 Karma

mayurr98
Super Champion

yeah the query is written in tstats (which will not allow you to look at the raw data and is basically use for faster processing of searches when data model acceleration is ON)

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...