topic Extract fields from syslog (new to splunk) in Getting Data In

Extract fields from syslog (new to splunk)

sja — Tue, 28 Aug 2012 12:21:04 GMT

Hi people

I have syslog out put like that :

ifIndex 1212, ifAdminStatus up(1), ifOperStatus up(1), ifName ge-1/1/1.32767
ifIndex 1211, ifAdminStatus up(1), ifOperStatus up(1), ifName ge-1/1/1.4093

......

I would like to to make ifName as the field and the ge-*/*/*.* as the value I like to get info about.

Re: Extract fields from syslog (new to splunk)

kristian_kolb — Tue, 28 Aug 2012 12:39:50 GMT

Have you looked at the Interactive Field Extractor (ifx)?

Other than that you can perform the field extraction on-the-fly in the search (it won't be stored anywhere);

your_search | rex "ifName (?<ifName>.*)$"

Hope this helps,

Kristian

Re: Extract fields from syslog (new to splunk)

sja — Tue, 28 Aug 2012 12:48:49 GMT

Yes thats works !!
Thanks!!