How to do Field extraction in splunk without sourcetype?

[smanojkumar]

Hi Splunkers!
   I need to extract the specific field which dosent consists of sourcetype in logs,

Is there is anything apart from Regex and Spath, i also welcomed, answers in different is needed.

Fields to extrcat - OS, OSRelease

Thanks in Advance,

Manoj Kumar S

[ITWhisperer]

| extract

[smanojkumar]

Hi @ITWhisperer ,

   Thanks for your response!

    Can you please help with query as well to extract, also, if possible, please share regex code as well.

Thanks is  Advance!

Manoj Kumar S

[ITWhisperer]

You said you didn't want regex or spath.

From the picture, which is not a good way to show your data by the way, it looks like it is reasonably structured with name/value pairs, which the extract command can extract into fields.

If this is not doing what you want, you should provide more information as to why it is not, and provide examples of your complete events (anonymised of course), but paste them into a codeblock </> so that we can use them to fabricate tests to resolve your issue.

Very few of us volunteers want to spend time trying to copy your example data from pictures.