topic Help extracting fields in Splunk Search

Help extracting fields

rmcdougal — Tue, 08 Jan 2013 16:46:20 GMT

I have a syslog input that has its field values in the following format and splunk isn't picking it up by default. How could I get splunk to correctly sourcetype this type:

"class":"sessionevent", "hostname":"bob"

Re: Help extracting fields

sdaniels — Tue, 08 Jan 2013 16:57:47 GMT

What is the data coming from? You could use the interactive field extractor in the UI to get Splunk to generate the regex for you.

http://www.splunk.com/view/SP-CAAADUY

Re: Help extracting fields

Rob — Mon, 28 Sep 2020 13:03:54 GMT

You can define the sourcetype of your events in the appropriate inputs.conf file for the syslog monitoring stanza you have setup with something similar to the following.

[tcp://syslog.corp.company.net:514]
sourcetype = syslog

Here is a link to the Splunk documentation for further information:

http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureyourinputs#A_word_about_source_types