Getting Data In

Extracting Fields using Regex

EHariharan
Explorer

Hi All,

TIME_PREFIX=
MAX_TIME_LOOKAHEAD=
LINE_BREAKER=

Below are the logs which need to be extracted. Kindly help!

LOGID USERTYPE OPERATORUSER OPERATORTYPE OPERATORNAME OPERATORTIME

6 ma*ge_an userClass deleteUser 2019-06-28 09:50:26
7 System administrator ma
ge_a***n userClass createUser 2019-06-28 09:50:3

Thanks in Advance!

Tags (1)
0 Karma

chinmoya
Communicator

it looks like all your headers are separated by a tab.
I would suggest you not use regex instead use a delimiter based approach with using tab as a delimiter.

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...