Getting Data In

How to extract this data from the log?

as2050
New Member

Hello,

I am fairly new to using splunk. I am having some trouble understanding how to extract the fields. 

My sample data looks somewhat like this:

...Event={request=Request{data={firstName=jane, lastName=doe, yearOfBirth=1996}}}...

I want to get count based on yearOfBirth. How should I do it?

I tried doing stats count by request.data.yearOfBirth, and also tried simply doing stats count by yearOfBirth but neither returned any results. Am I accessing the yearOfBirth field incorrectly?
How can I 

Labels (1)
0 Karma

somesoni2
Revered Legend

Check what fields are available in your data by checking field sidebar (left hand panel when you run your search). You can click on a field so see what way the field should be referred. 

If you don't see any relevant field extracted, make sure that you're using correct Search mode (dropdown below time range picker, select Smart Mode OR Verbose Mode). If you still don't see a field for yearOfBirth, try this

your base search (index=x sourcetype=y)
| rex "yearOfBirth\=(?<yearOfBirth>\d+)"
| stats count by yearOfBirth
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...