Getting Data In

Extract fields from syslog (new to splunk)

sja
New Member

Hi people

I have syslog out put like that :

ifIndex 1212, ifAdminStatus up(1), ifOperStatus up(1), ifName ge-1/1/1.32767
ifIndex 1211, ifAdminStatus up(1), ifOperStatus up(1), ifName ge-1/1/1.4093

......

I would like to to make ifName as the field and the ge-*/*/*.* as the value I like to get info about.

Tags (2)
0 Karma

sja
New Member

Yes thats works !!
Thanks!!

0 Karma

kristian_kolb
Ultra Champion

Have you looked at the Interactive Field Extractor (ifx)?

Other than that you can perform the field extraction on-the-fly in the search (it won't be stored anywhere);

your_search | rex "ifName (?<ifName>.*)$" 

Hope this helps,

Kristian

Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...