How to break events while indexing

moohkhol — Mon, 28 Sep 2020 15:32:56 GMT

Hi,

I have events which logging user agents information,

USR_AGNT="Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36"

In the above log events, we have browser information as well as OS information, How i can transform it while indexing into two different key such OS_INFO (operating system related information) and BRW_INFO (Browser related information) under USR_AGNT.

Re: How to break events while indexing

martin_mueller — Fri, 27 Dec 2013 08:42:16 GMT

You can extract that information at search time as you normally would for any field. See http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutfields for more.

Note, breaking events is a different thing - see http://docs.splunk.com/Documentation/Splunk/latest/Data/Indexmulti-lineevents for that.

topic How to break events while indexing in Getting Data In

How to break events while indexing

Re: How to break events while indexing