Splunk Search

How to access values from event in Splunk

gauravepi
Path Finder

I want to access the values of the events that are coming after splunk search .

Data is coming in below format on the event

18/06/28 14:12:07 250  219561  711914   72864    0  784778 - 18-06-28 14:08:43

I want to access certain values from this list like i want to access : 18/06/28 14:12:07 , 784778 and 18-06-28 14:08:43

Please suggest how we can do this in splunk ?

Tags (1)
0 Karma

woodcock
Esteemed Legend

I use Regex101.com for this: https://regex101.com/r/7bVxvt/1

This RegEx does the trick. Just set it up as a Field Extraction:

^(?<datetime1>\d+\/\d+\/\d+\s+\d+:\d+:\d+)\s+(?<field1>\d+)\s+(?<field2>\d+)\s+(?<field3>\d+)\s+(?<field4>\d+)\s+(?<field5>\d+)\s+(?<field6>\d+)\s+(?<field7>\S+)\s+(?<datetime2>\d+-\d+-\d+\s+\d+:\d+:\d+)
0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

It sounds like you want to extract fields from your data. This is assuming you are already ingesting it into Splunk. Depending on the type of data, you should always check splunkbase.com first to see if there is an app or add-on for that data source. The add-ons will have the field extractions done for these sources. If it is something custom or there isn't an add-on available, you can extract fields through the GUI see docs here.

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...