Below is my applogs data:
{"name":"blink-api-manager","submodule":"perfLogger","level":30,"req":{"url":"/api/accounts/transfers/retrieveAccounts","method":"GET","uuid":"ciqki748r0ur3tvmx6nlh7k3s"},"APIResponseTime":{"AccountsView.findByCustomerId":{"api":892.391628}},"OverallResponseTime":894.698927,"msg":"","time":"2016-07-13T06:26:24.069Z","v":0}
I have more than 20K data and need to filter 4 values: URL - APIResponseTime - OverallResponseTime - Time orderwise and need to download it in a CSV format. How it can be done?
Run following search and export result as csv
Your base search | rename req.* as * | table url APIResponseTime OVerallResponseTime time
See this for export method
http://docs.splunk.com/Documentation/Splunk/6.4.1/Search/Exportsearchresults#Export_data_using_Splun...
Run following search and export result as csv
Your base search | rename req.* as * | table url APIResponseTime OVerallResponseTime time
See this for export method
http://docs.splunk.com/Documentation/Splunk/6.4.1/Search/Exportsearchresults#Export_data_using_Splun...
Thanks for the info, it just worked with table command itself.
May need spath
before rename?
The data looks like a valid JSON , if the sourcetype is configured correctly then the JSON should be parsed correctly with fields already available. But you're correct if that's not the case. Sathish to confirm how his logs are setup/looking in Splunk.
Yes its a valid JSON and since fields were already available, splunk parsed it correctly