Hi team,
I have a huge JSON event out of which I want to parse only a few fields. I am using splunk 6.2.2. I tried to use field extractor but it behaves vague sometimes. It doesnt show up the value intended and displays blank. (Its unable to get the field consistently)
{"appName":"Jump","container":"Victor","file":"/root/go/src/winapp/Apping.po","func":"us/plugins/FriendlyPuddling.(*Bpp).Run","level":"info","line":226,"msg":"Publish:Count","time":"2011-10-11T12:30:20-05:00","values":"{\"Batch Processing Time Distributing\":{\"15m.rate\":0.9826029793743358,\"1m.rate\":0.7673693674154273,\"5m.rate\":0.9483630678135541,\"75%\":1.5436909406295e+12,\"95%\":1.74949310431975e+12,\"99%\":1.79064985634111e+12,\"99.9%\":1.799911077441748e+12,\"count\":216619,\"max\":1799940089952,\"mean\":1.2837037035597275e+12,\"mean.rate\":0.5485299415610289,\"median\":1.286439928609e+12,\"min\":486941182907,\"stddev\":3.0184924744029645e+11},\"Fetched Row Distribution\":{\"75%\":1978,\"95%\":17389.049999999865,\"99%\":39212.23999999999,\"99.9%\":46182,\"count\":2238,\"max\":46182,\"mean\":3060.0583333333334,\"median\":700.5,\"min\":1,\"stddev\":7079.815472480549},\"Fetching Time Distributing\":{\"15m.rate\":0.008681253423841689,\"1m.rate\":0.08356982935086356,\"5m.rate\":0.019364352288179648,\"75%\":7.172491315e+08,\"95%\":2.642261091499997e+09,\"99%\":5.112135282370001e+09,\"99.9%\":5.937299762975e+09,\"count\":2238,\"max\":5940880066,\"mean\":6.478074835447471e+08,\"mean.rate\":0.005666979245204095,\"median\":3.334446995e+08,\"min\":46682300,\"stddev\":9.676797891857135e+08},\"Process Time Distributing\":{\"15m.rate\":0.0002367706853682747,\"1m.rate\":1.6264306597703286e-15,\"5m.rate\":8.353983878553906e-06,\"75%\":4.80734255e+07,\"95%\":8.514038799999999e+07,\"99%\":1.51294623419999e+08,\"99.9%\":2.02493557e+08,\"count\":265,\"max\":202493557,\"mean\":2.8526392818867926e+07,\"mean.rate\":0.0006710334622203678,\"median\":1.4835899e+07,\"min\":358789,\"stddev\":3.140586975657637e+07},\"Processed Appling in Last Batch\":{\"value\":3989},\"Process Rows in Last\":{\"value\":68796},\"Row Fetching Rate\":{\"15m.rate\":41.18225939270318,\"1m.rate\":368.06998983168285,\"5m.rate\":84.80994027088143,\"count\":6422723,\"mean.rate\":16.26337709341583},\"Row Processing Rate\":{\"15m.rate\":12.538154985883653,\"1m.rate\":1.0371260388157613e-10,\"5m.rate\":0.5328477092064106,\"count\":6422723,\"mean.rate\":16.263630383100814},\"Total Applis Processed\":{\"count\":31782478},\"Total Process Timing\":{\"count\":572465},\"Total Query Execution Timing\":{\"count\":52154458},\"Total Rows Count\":{\"count\":514522696}}\n","version":"1.0.0"}
I want to extract the below fields only
Total Applis Processed
Total Rows Count
Total Query Execution Timing
Row Fetching Rate
Processed Appling in Last Batch
Could you please let me know is there a way this could fields could be easily extracted from Splunk....
Any help would be highly appreciated.
↧