Extract fields from syslog (new to splunk)

[sja]

Hi people

I have syslog out put like that :

ifIndex 1212, ifAdminStatus up(1), ifOperStatus up(1), ifName ge-1/1/1.32767
ifIndex 1211, ifAdminStatus up(1), ifOperStatus up(1), ifName ge-1/1/1.4093

......

I would like to to make ifName as the field and the ge-*/*/*.* as the value I like to get info about.

[sja]

Yes thats works !!
Thanks!!

[kristian_kolb]

Have you looked at the Interactive Field Extractor (ifx)?

Other than that you can perform the field extraction on-the-fly in the search (it won't be stored anywhere);

your_search | rex "ifName (?<ifName>.*)$" 

Hope this helps,

Kristian