topic Re: Field extraction in splunk without sourcetype in Getting Data In

How to do Field extraction in splunk without sourcetype?

smanojkumar — Thu, 17 Aug 2023 18:10:10 GMT

Hi Splunkers!
I need to extract the specific field which dosent consists of sourcetype in logs,

Is there is anything apart from Regex and Spath, i also welcomed, answers in different is needed.

Fields to extrcat - OS, OSRelease

Thanks in Advance,

Manoj Kumar S

Re: Field extraction in splunk without sourcetype

ITWhisperer — Thu, 17 Aug 2023 15:58:41 GMT

| extract

Re: Field extraction in splunk without sourcetype

smanojkumar — Fri, 18 Aug 2023 07:02:00 GMT

Hi @ITWhisperer ,

Thanks for your response!

Can you please help with query as well to extract, also, if possible, please share regex code as well.

Thanks is Advance!

Manoj Kumar S

Re: Field extraction in splunk without sourcetype

ITWhisperer — Fri, 18 Aug 2023 07:18:05 GMT

You said you didn't want regex or spath.

From the picture, which is not a good way to show your data by the way, it looks like it is reasonably structured with name/value pairs, which the extract command can extract into fields.

If this is not doing what you want, you should provide more information as to why it is not, and provide examples of your complete events (anonymised of course), but paste them into a codeblock </> so that we can use them to fabricate tests to resolve your issue.

Very few of us volunteers want to spend time trying to copy your example data from pictures.