分类： IT

一个常用的Splunk查询例子

index=”actioncenter” | search “msg.Results.TraceLevel”=Error | search cf_app_name=”AccountOpenBFFAPI*” | search “msg.Results.Message”=”HTTP Response: {\”message\”:\”Invalid Role Title Code*with Customer Type BENE combination.*” | spath output=EnvelopeId path=msg.Extended_Fields.EnvelopeId | where isnotnull(EnvelopeId) | spath output=ActionId path=msg.Extended_Fields.ActionId | eval time =strftime(_time, “%m-%d-%Y %l:%M %p”) | table time, EnvelopeId, ActionId | stats list(time) by EnvelopeId,ActionId

table 和 stats list并不都需要，看实际情况。

“trap” in json-schema

https://json-schema.org/understanding-json-schema/reference/conditionals.html

Note:

In this example, “country” is not a required property. Because the “if” schema also doesn’t require the “country” property, it will pass and the “then” schema will apply. Therefore, if the “country” property is not defined, the default behavior is to validate “postal_code” as a USA postal code.

The “required” keyword is necessary in the “if” schemas or they would all apply if the “country” is not defined.

所以json schmea默认一个属性如果不存在，居然算是if该属性的条件通过的，然后会进入then环节执行。如果要存在且等于某一个常量，要写成

"if": {
        "properties": { "country": { "const": "Netherlands" } },
        "required": ["country"]
      }