splunk - 如何优化以下 Splunk 查询？

Question

我有如下结果：

 1. DateTime=2019-07-02T16:17:20,913 Thread=[],  Message=[Message(userId=124, timestamp=2019-07-02T16:17:10.859Z, notificationType=CREATE, userAccount=UserAccount(firstName=S, lastName=K, emailAddress=abc@xyz.com, status=ACTIVE), originalValues=OriginalValue(emailAddress=null)) Toggle : true]


 2. DateTime=2019-07-02T16:18:20,913 Thread=[],  Message=[Message(userId=124, timestamp=2019-07-02T16:17:10.859Z, notificationType=CREATE, userAccount=UserAccount(firstName=S, lastName=K, emailAddress=abc@xyz.com, status=ACTIVE), originalValues=OriginalValue(emailAddress=new@xyz.com)) Toggle : true]


 3. DateTime=2019-07-02T16:19:20,913 Thread=[],  Message=[Message(userId=124, timestamp=2019-07-02T16:17:10.859Z, notificationType=CREATE, userAccount=UserAccount(firstName=S, lastName=K, emailAddress=abc@xyz.com, status=ACTIVE), originalValues=OriginalValue(emailAddress=new@xyz.com)) Toggle : true]

我正在尝试对整个"Message"字段的内容相同"emailAddress=null"且不包含在消息中的结果进行分组。

So in the results above 2 and 3 should be the output.

以下查询对我来说很好，但我需要根据以下条件进一步优化它：

工作查询：index=app sourcetype=appname host=appname* splunk_server_group=us-east-2 | fields Message | search Message= "[Message*" | regex _raw!="emailAddress=null" | stats count(Message) as count by Message | where count > 1

优化条件

• 不能针对原始的
• 消息键/值对需要在主搜索中，而不是子搜索中

Answer 1

当前查询中没有任何子搜索。子搜索是用方括号括起来的查询。

rex 对 _raw 有什么问题？

尝试这个：

index=app sourcetype=appname host=appname* splunk_server_group=us-east-2 Message="[Message*" 
| fields Message 
| regex Message!="emailAddress=null" 
| stats count(Message) as count by Message | where count > 1