Splunk Search

How to list of search results with a value > X in a specific search field

alysea
New Member

Hello,

I have the following field:= message.msg:

msg: before send to xxx, payload = {"id":"abc123","userId":1,"currency":1,"amount":"-54"}   

I would like to find all search results where amount is <= -50.
How is it possible to do so?

Please let me know if any further information is required.

Thanks in advance!

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

| makeresults | eval "message.msg" = "msg: before send to xxx, payload = {\"id\":\"abc123\",\"userId\":1,\"currency\":1,\"amount\":\"-54\"}"

| rename COMMENT AS "Everything above generates sample events; everything below is your solution"

| rename message.msg AS _raw
| rex mode=sed "s/^[^\{]+//"
| spath
| where amount<=-50

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults | eval "message.msg" = "msg: before send to xxx, payload = {\"id\":\"abc123\",\"userId\":1,\"currency\":1,\"amount\":\"-54\"}"

| rename COMMENT AS "Everything above generates sample events; everything below is your solution"

| rename message.msg AS _raw
| rex mode=sed "s/^[^\{]+//"
| spath
| where amount<=-50
0 Karma

Sukisen1981
Champion

hi @alysea
This json field will perhaps have the amount in the payload field. Please check your interesting fields , I think your json values are mapped to the field called 'payload' and not message. The regex by @richgalloway is correct.
Try this if the json values are coming in a field called 'payload'

|  rex field=payload "amount\"+\:+\"(?<amount>.*?)\"" 
|  where amount < -50
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's one way.

... | rex field=message "amount":"(?<amount>-?\d+)" | where amount < -50
---
If this reply helps you, Karma would be appreciated.

alysea
New Member

Thank you for the help!

0 Karma

alysea
New Member

Thank you, I will try and let you know if it works out 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...