Getting Data In

Extract fields from syslog (new to splunk)

sja
New Member

Hi people

I have syslog out put like that :

ifIndex 1212, ifAdminStatus up(1), ifOperStatus up(1), ifName ge-1/1/1.32767
ifIndex 1211, ifAdminStatus up(1), ifOperStatus up(1), ifName ge-1/1/1.4093

......

I would like to to make ifName as the field and the ge-*/*/*.* as the value I like to get info about.

Tags (2)
0 Karma

sja
New Member

Yes thats works !!
Thanks!!

0 Karma

kristian_kolb
Ultra Champion

Have you looked at the Interactive Field Extractor (ifx)?

Other than that you can perform the field extraction on-the-fly in the search (it won't be stored anywhere);

your_search | rex "ifName (?<ifName>.*)$" 

Hope this helps,

Kristian

Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...