Hi I am new to splunk
I wanted to extract data from logs that have a particular string with a value and only return data where the extracted value is 100 or greater.
ID: 2999
Payload: {"Audit":{"__queryElapsedTime":"267","__requestReceived":"2014.09.04 06:01:04.560
Address: sdfjkjsdljsjdjjkljsd";k;lklsdk
Here is my logs I wanted to search ID , Payload , Address and list in table
ID Address Payload
2999 sdjsdjj;'lkdfj;ksfdk {"Audit":{"queryElapsedTime":"267","requestReceive
Please help me I am stuck with prod issue.
Hello
Try this:
your base search ... | rex "queryElapsedTime\"\:\"(?<queryelapsedtime>\d+)\"" | search queryelapsedtime > 99 | stats count, values(queryelapsedtime) by _time
Regards
Hi gluente Thanks for your answer its working fine now I need the above sample which is edited Please give me some trick