topic Re: field extraction in Splunk Search

field extraction

ChhayaV — Tue, 06 Aug 2013 04:07:43 GMT

hi,

I have a log files which are having columns that are not fixed.
if first log entry has col1,col2,col3 then next entry can have col4,col5 only can i analyze and extract fields from such columns

Thanks and Regards

Re: field extraction

linu1988 — Tue, 06 Aug 2013 04:55:48 GMT

Please provide us with sample logs. Try extracting the logs from Splunk UI, remove the matches which you don't want.

Re: field extraction

kml_uvce — Tue, 06 Aug 2013 05:45:31 GMT

If you have diffrent searches for diffrent column combination then just extract fields from Splunk UI.