I have events in splunk like this
code=123 name="somename1" data={ _id = "someid1"}
code=123 name="somename2" data={ _id = "someid2"}
I wanted to search on the base of code and _id and my query is like this
code=123 _id="someid1"
But this query does not give me any result probably because _id is nested under data. How to write the query so that I can get the result in correct format.
Hi sanchitlohia,
you could search for this: code=123 data="{ _id=*"
I would suggest that you extract the id as new field like this:
code=123 | rex field=data "\_id\s\=\s\"(?<my_id>[\w\d]+)\"" | table my_id
if this helps, you can setup search time field extraction http://docs.splunk.com/Documentation/Splunk/6.1.3/Knowledge/Addfieldsatsearchtime to get this id field in all searches
hope this helps to get you started ...
cheers, MuS