Archive

How to access values from event in Splunk

Path Finder

I want to access the values of the events that are coming after splunk search .

Data is coming in below format on the event

18/06/28 14:12:07 250  219561  711914   72864    0  784778 - 18-06-28 14:08:43

I want to access certain values from this list like i want to access : 18/06/28 14:12:07 , 784778 and 18-06-28 14:08:43

Please suggest how we can do this in splunk ?

Tags (1)
0 Karma

Esteemed Legend

I use Regex101.com for this: https://regex101.com/r/7bVxvt/1

This RegEx does the trick. Just set it up as a Field Extraction:

^(?<datetime1>\d+\/\d+\/\d+\s+\d+:\d+:\d+)\s+(?<field1>\d+)\s+(?<field2>\d+)\s+(?<field3>\d+)\s+(?<field4>\d+)\s+(?<field5>\d+)\s+(?<field6>\d+)\s+(?<field7>\S+)\s+(?<datetime2>\d+-\d+-\d+\s+\d+:\d+:\d+)
0 Karma

Splunk Employee
Splunk Employee

It sounds like you want to extract fields from your data. This is assuming you are already ingesting it into Splunk. Depending on the type of data, you should always check splunkbase.com first to see if there is an app or add-on for that data source. The add-ons will have the field extractions done for these sources. If it is something custom or there isn't an add-on available, you can extract fields through the GUI see docs here.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!