Splunk Enterprise

How can I return all elements greater than or less than?

tsushi
Explorer

Hi,

I'm new to Splunk so this is really basic.
I can use this search

host=PChistory_1 participant_count=5

and I will get all elements where participant_count is exactly 5.
But, greater than or less than does not work.

host=PChistory_1 participant_count<5

will give me no results.

Not sure what I'm doing wrong.

This is example of one log element:

{
        "name": "Company xx", 
        "participant_count": 2, 
        "start_time": "2018-03-16T14:26:08", 
        "service_type": "conference", 
        "participants": [
            "/api/admin/history/v1/participant/149a6a3c-fb22-436a-b267-f649c131f1d6/", 
            "/api/admin/history/v1/participant/35e86e0e-f470-4259-8a5f-4f4b47c97d41/"
        ], 
        "tag": "", 
        "end_time": "2018-03-16T14:30:15.104681", 
        "instant_message_count": 0, 
        "unique_participant_count": 2, 
        "duration": 247, 
        "id": "c12509d6-ab15-49e2-9e38-38c551096cc8", 
        "resource_uri": "/api/admin/history/v1/conference/c12509d6-ab15-49e2-9e38-38c551096cc8/"
    }
0 Karma
1 Solution

tiagofbmm
Influencer

Are you indexing this with sourcetype JSON?

I picked up your exact example, indexed with JSON and tried both:

host=PChistory_1 participant_count=2

and

 host=PChistory_1 participant_count>1

And got the expected behaviour on both.

Please check that sourcetype and let me know

View solution in original post

tiagofbmm
Influencer

Are you indexing this with sourcetype JSON?

I picked up your exact example, indexed with JSON and tried both:

host=PChistory_1 participant_count=2

and

 host=PChistory_1 participant_count>1

And got the expected behaviour on both.

Please check that sourcetype and let me know

tsushi
Explorer

This was the problem indeed. I thought I had chosen JSON the first time and chosen my timestamps. Did it again now and it works beautifully 🙂 Not sure what I did wrong the first time, but probably some basic mistake.

0 Karma

elliotproebstel
Champion

The answer below from @tiagofbmm should work, but it's not as efficient as filtering in the base search. I'm surprised that the query you posted isn't working, because such structure works in my environment. Does it return no results at all, or just fail to return some results you know it should be returning?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...