编写splunk查询获取大于零的工作日数答案

【问题标题】：Write splunk query to fetch the number of working days greater than zero编写splunk查询获取大于零的工作日数
【发布时间】：2022-01-04 07:41:15
【问题描述】：

我正在尝试编写一个 splunk 查询，如果它大于零，我需要获取带有工作日数的用户详细信息。例如我有以下数据

I, [2022-01-04T01:32:10.165065 #21461]  INFO -- : fetched user details for user_id: 5612 with working_days: 0

I, [2021-01-04T01:32:10.165065 #21461]  INFO -- : fetched user details for user_id: 5619 with working_days: 10

I, [2021-02-04T01:28:10.165065 #21461]  INFO -- : fetched user details for user_id: 8901 with working_days: 0

I, [2021-03-04T01:18:10.165065 #21461]  INFO -- : fetched user details for user_id: 306561 with working_days: 35

我需要获取 user_id 和 working_days。唯一的条件是工作日大于0

fetched user details for user_id: 5619 with working_days: 10
fetched user details for user_id: 306561 with working_days: 35

下面的查询没有给出正确的结果。任何帮助表示赞赏

"fetched user details for user_id: " 
| rex field=_raw "fetched user details for user_id:(?<user_id>.*) with working_days:(?<working_days>.*)" 
| table user_id,working_days

更新 1

我尝试了以下方法，但都不起作用

"fetched user details for user_id: " 
| rex field=_raw "fetched user details for user_id:(?<user_id>.\d+) with working_days:(?<working_days>.\d+)" 
| where working_days > 0 | table user_id,working_days

"fetched user details for user_id: " 
| rex field=_raw "fetched user details for user_id:(?<user_id>.\d+) with working_days:(?<working_days>.\d+)" 
| where 'working_days' > 0 | table user_id,working_days

"fetched user details for user_id: " 
| rex field=_raw "fetched user details for user_id:(?<user_id>.\d+) with working_days:(?<working_days>.\d+)" 
| where working_days > '0' | table user_id,working_days

"fetched user details for user_id: " 
| rex field=_raw "fetched user details for user_id:(?<user_id>.\d+) with working_days:(?<working_days>.\d+)" 
| where "working_days" > '0' | table user_id,working_days

"fetched user details for user_id: " 
| rex field=_raw "fetched user details for user_id:(?<user_id>.\d+) with working_days:(?<working_days>.\d+)" 
| where not working_days == 0 | table user_id,working_days

【问题讨论】：

标签： splunk splunk-query

【解决方案1】：

使用where 或search 命令过滤结果。

"fetched user details for user_id: " 
| rex field=_raw " user_id:(?<user_id>\d+) with working_days:(?<working_days>\d+)" 
| search working_days > 0
| table user_id,working_days

【讨论】：

我尝试过使用 where 子句，但它不起作用
我们应该如何处理“它不起作用”？请分享您正在运行的完整查询并描述或发布结果。然后我们可以建议其他的尝试。有时| search working_days > 0 的结果比where 更好。
|搜索 working_days > 0 为我工作。谢谢你可以更新现有的答案