Getting Data In

How to extract ingested data and display in interesting fields ?

Kumar2
Loves-to-Learn Lots

Example: MyNameisKumar I want name=kumar from this ingested Data . Please help me with the solution 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Kumar2,

as you can see at https://docs.splunk.com/Documentation/Splunk/8.2.3/Knowledge/WhatisSplunkknowledge Splunk recognize by itself the pairs "field=value".

For the other extraction you can use a Technical Add-On for the standard sources (e.g. Windows, Linux, etc...) or for other sources you have to extract fields by yourself identifying the rule to extract the field and creating a regex.

I could help you if you share some sample of your logs indicating what you want to extract.

regex101.com could help you.

using your sample:

| rex "MyNameis(?<name>\w+)"

that you can test at https://regex101.com/r/PIXYtT/1 

Ciao.

Giuseppe

0 Karma

Kumar2
Loves-to-Learn Lots

No sir

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...