I am trying to extract a field after a specific expression using regex and then running a query which counts the events where this condition is met. I did this:
query | rex field=_raw "text: (?<value>d+)" | timechart partial=f span=5m count as numbers | where value > 3
There are some log-entries for which value is greater than 3, but nevertheless this events are not counted. What did I do wrong here and why did I not get a result?
Put your where before your time chart
Using the 8 events, I can select those which are greater than 3
source="splunk.txt" host="stack" index="stack" sourcetype="raw_line_break" | rex "text: (?<value>d)" | where value > 3 | timechart partial=f span=5m count as numbers
this returns me a count of 2 since only two events in that time window were greater than 3
Read more here: Source link