Security

how do i access a field that is not listed?

dgonzales999
New Member

How do I access "processing_time" from the data below. I want to get the average time. It is not listed as a field.
{"@type":"log:LogIncomingRequestEvent","level":"INFO","when":"2014-05-29 16:04:06,459","method":"LogFilter.logIncomingRequest#156","thread":"http-bio-8087-exec-4","init_tid":"b0507da3-6687-4028-8fe2-8c98c92b783d","request":{ "@type":"log:IncomingRequest", "client_ip":"pqal.corp.net","http_method":"POST","url":"/mms/v1/transfers","user_agent":"Apache-HttpClient/4.3.2 (java 1.5)","processing_time":137},"msg":"OK"}

Tags (1)
0 Karma

stefandagerman
Path Finder

Can you not set KV_MODE=JSON (your event looks like it is valid JSON) in props.conf for the sourcetype and let Splunk do the work for you?
props.conf docs

somesoni2
SplunkTrust
SplunkTrust

It is a valid json, validated from http://jsonlint.com/. Once you import the data with KV_MODE=JSON, you should be able to see fields like 'request.processing_time' and then you can use 'stats' command to get the average.

0 Karma

grijhwani
Motivator

Easiest way is to use the field extractor tool.

Generate a search that contains it then select the drop-down next to one of the presented records, and select "field extractor".

http://docs.splunk.com/Documentation/Splunk/6.1.1/Knowledge/ExtractfieldsinteractivelywithIFX

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...