Why is extracted field formatted incorrectly?

yk010123 — Thu, 10 Mar 2022 00:28:45 GMT

I have the following log that Splunk is not recognizing well :

msg=id=123342521352 operation=write

How can I write a query so that ID is parsed by itself?

The goal is to be able to build a table like :

id	operation
123342521352	write

Unfortunately, when I tried

table id operation

The id is always empty as it does not seem to be parsed correctly

Re: Why is extracted field formatted incorrectly?

yuanliu — Thu, 10 Mar 2022 03:32:26 GMT

If you look at events, you'll find the field msg with "id" as value. In SPL, you can use rex to extract id as a field, e.g.,

| rex "msg=id=(?<id>\d+)"