unstructured logs how to extract the given item example

mindia — Fri, 14 Sep 2018 12:26:44 GMT

The unsturctured log contains many lines and at the end below coverage report, it is not getting captured as a field, even Extract new field, when I tried, it is adding junk data in the fields covering other lines

line1
line2
..
...
line n
============ coverage report ==========
Statements : 34% (20/22)

Lines : 56% (56/100)

Is it possible to create a search query which would generate the table like

_time Statements Lines
14-9-2018 34% 56%

Since the coverage report is unstructured not able to capture the details as a field.... any suggestions are welcome.

Thanks!.

Re: unstructured logs how to extract the given item example

493669 — Fri, 14 Sep 2018 14:08:14 GMT

Hi @mindia,
you can try this on raw data :

...|rex "Statements : (?<Statements>[^\s+]+).*Lines : (?<Lines>[^\s+]+)"|table _time, Statements , Lines

topic Re: unstructured logs how to extract the given item example in Splunk Dev

unstructured logs how to extract the given item example

Lines : 56% (56/100)

Re: unstructured logs how to extract the given item example