https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/44856#M10598 <P>See these docs pages.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Tutorial/Aboutgettingdatain">http://docs.splunk.com/Documentation/Splunk/latest/Tutorial/Aboutgettingdatain</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor">http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor</A></P> <P>since you don't seem to have a timestamp in your events, you'd probably need to set DATETIME_CONFIG = CURRENT in props.conf for your sourcetype.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf</A></P> <P>As for field extraction, the command <CODE>spath</CODE> can be used to extract fields from JSON-formatted data (which is what that looks like).</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Spath">http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Spath</A></P> <P>Hope this helps,</P> <P>K </P> Fri, 24 May 2013 07:09:01 GMT kristian_kolb 2013-05-24T07:09:01Z https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/44855#M10597 <P>can somebody help on how to import the log file of the below format to splunk ?</P> <P>{"Error":[{"session":abc123,"app_id":12345,"error_reason":700,"app_version:"1.0"},{{"session":abc345,"app_id":67890,"error_reason":123,"app_version:"1.0"},{{"session":abc678,"app_id":123789,"error_reason":701,"app_version:"1.1"},"status":"success","current_page":1,"per_page":100,"total_entries":3,"total_pages":1}</P> Mon, 28 Sep 2020 13:58:20 GMT https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/44855#M10597 msn2507 2020-09-28T13:58:20Z https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/44856#M10598 <P>See these docs pages.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Tutorial/Aboutgettingdatain">http://docs.splunk.com/Documentation/Splunk/latest/Tutorial/Aboutgettingdatain</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor">http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor</A></P> <P>since you don't seem to have a timestamp in your events, you'd probably need to set DATETIME_CONFIG = CURRENT in props.conf for your sourcetype.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf</A></P> <P>As for field extraction, the command <CODE>spath</CODE> can be used to extract fields from JSON-formatted data (which is what that looks like).</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Spath">http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Spath</A></P> <P>Hope this helps,</P> <P>K </P> Fri, 24 May 2013 07:09:01 GMT https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/44856#M10598 kristian_kolb 2013-05-24T07:09:01Z