topic Re: Splunk Search content for a particular string in Splunk Search

Splunk Search content for a particular string

kaushal21rajput — Thu, 19 Jul 2018 06:57:32 GMT

Hi Team,

I have search in search head which gives output like in snapshot.
Now i want to assign a new field to client no like client 26 , client 31 . All these (client 26, client 31 etc) should have a particular field.
I have tried to used eval command but did not get exact function to be used.
Please help me . Snapshot is attached.

Re: Splunk Search content for a particular string

FrankVl — Thu, 19 Jul 2018 10:35:34 GMT

Assuming you want to extract the number into a field called client, you can do that using the rex command:

| rex "client\s+(?<client>\d+)\s+connected"

Re: Splunk Search content for a particular string

ddrillic — Thu, 19 Jul 2018 10:50:16 GMT

I think Frank meant - client\s+(?<client>\d+)\s+connected

Re: Splunk Search content for a particular string

FrankVl — Thu, 19 Jul 2018 11:04:21 GMT

Oh, yeah, sorry, forgot to post it as code, which makes the triangular brackets disappear. Fixed it 🙂

Re: Splunk Search content for a particular string

ddrillic — Thu, 19 Jul 2018 11:07:12 GMT

Fun stuff ; -)

Re: Splunk Search content for a particular string

kaushal21rajput — Tue, 24 Jul 2018 08:01:43 GMT

Hi Ddrillic/FrankVI ,

I want to assign output value like "client 26 , client 36" to an another field .

These values should be visible in interesting fields.

That is my question.