https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-raw-field/m-p/52352#M12718 <P>Hi All,</P> <P>I am new to Splunk.<BR /> I have informatica log.i have uploaded into splunk.when i am searching i am getting 5 fields.<BR /> in that 5 fields i have _raw field that contains all the fields that i want in my Report.</P> <PRE><CODE>_time host sourcetype source _raw 6 6/28/12 7:09:35.000 AM NODE_DEV Informatica S_M_O1_HR_APPL_ASSIGN_EXTRACT.txt 2012-06-28 07:09:35 : INFO : (28947 | DIRECTOR) : (IS | Integration_Service_Dev) : NODE_DEV : CMN_1740 : Table: [SQ_IRC_ASSIGNMENT_STATUSES] (Instance Name: [SQ_IRC_ASSIGNMENT_STATUSES]) Output Rows [5497], Affected Rows [5497], Applied Rows [5497], Rejected Rows [0] </CODE></PRE> <P>_raw field contains Instance Name,Output Rows,Affected Rows,Applied Rows,Rejected Rows.<BR /> My requirement is i want Instance Name,Output Rows,Affected Rows,Applied Rows,Rejected Rows to be displayed as seperate fields in my report.</P> <P>Please suggest me the Solve.</P> <P>Reply ASAP.<BR /> Thanks and Regards<BR /> Kiran Kumar</P> Thu, 06 Sep 2012 07:09:02 GMT kiran4splunk 2012-09-06T07:09:02Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-raw-field/m-p/52352#M12718 <P>Hi All,</P> <P>I am new to Splunk.<BR /> I have informatica log.i have uploaded into splunk.when i am searching i am getting 5 fields.<BR /> in that 5 fields i have _raw field that contains all the fields that i want in my Report.</P> <PRE><CODE>_time host sourcetype source _raw 6 6/28/12 7:09:35.000 AM NODE_DEV Informatica S_M_O1_HR_APPL_ASSIGN_EXTRACT.txt 2012-06-28 07:09:35 : INFO : (28947 | DIRECTOR) : (IS | Integration_Service_Dev) : NODE_DEV : CMN_1740 : Table: [SQ_IRC_ASSIGNMENT_STATUSES] (Instance Name: [SQ_IRC_ASSIGNMENT_STATUSES]) Output Rows [5497], Affected Rows [5497], Applied Rows [5497], Rejected Rows [0] </CODE></PRE> <P>_raw field contains Instance Name,Output Rows,Affected Rows,Applied Rows,Rejected Rows.<BR /> My requirement is i want Instance Name,Output Rows,Affected Rows,Applied Rows,Rejected Rows to be displayed as seperate fields in my report.</P> <P>Please suggest me the Solve.</P> <P>Reply ASAP.<BR /> Thanks and Regards<BR /> Kiran Kumar</P> Thu, 06 Sep 2012 07:09:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-raw-field/m-p/52352#M12718 kiran4splunk 2012-09-06T07:09:02Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-raw-field/m-p/52353#M12719 <P>See <A href="http://docs.splunk.com/Documentation/Splunk/latest/User/InteractiveFieldExtractionExample">http://docs.splunk.com/Documentation/Splunk/latest/User/InteractiveFieldExtractionExample</A></P> <P>Once you have your fields defined you can simply report on them in a tabular fashion:</P> <PRE><CODE>... | table _time, InstanceName,OutputRows,AffectedRows,AppliedRows,RejectedRows </CODE></PRE> <P>Or create sophisticated charts and reports</P> <PRE><CODE>... | stats sum(OutputRows) by InstanceName </CODE></PRE> Thu, 06 Sep 2012 08:42:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-raw-field/m-p/52353#M12719 ayme 2012-09-06T08:42:11Z