How to extract ingested data and display in interesting fields ?

Kumar2 — Fri, 03 Dec 2021 14:25:30 GMT

Example: MyNameisKumar I want name=kumar from this ingested Data . Please help me with the solution

Re: How to extract ingested data and display in interesting fields ?

gcusello — Fri, 03 Dec 2021 14:50:50 GMT

as you can see at https://docs.splunk.com/Documentation/Splunk/8.2.3/Knowledge/WhatisSplunkknowledge Splunk recognize by itself the pairs "field=value".

For the other extraction you can use a Technical Add-On for the standard sources (e.g. Windows, Linux, etc...) or for other sources you have to extract fields by yourself identifying the rule to extract the field and creating a regex.

I could help you if you share some sample of your logs indicating what you want to extract.

regex101.com could help you.

using your sample:

| rex "MyNameis(?<name>\w+)"

that you can test at https://regex101.com/r/PIXYtT/1

Ciao.

Giuseppe

Re: How to extract ingested data and display in interesting fields ?

Kumar2 — Tue, 07 Dec 2021 08:58:49 GMT

No sir

topic How to extract ingested data and display in interesting fields ? in Getting Data In

How to extract ingested data and display in interesting fields ?

Re: How to extract ingested data and display in interesting fields ?

Re: How to extract ingested data and display in interesting fields ?