Getting Data In

How to extract this data from the log?

as2050
New Member

Hello,

I am fairly new to using splunk. I am having some trouble understanding how to extract the fields. 

My sample data looks somewhat like this:

...Event={request=Request{data={firstName=jane, lastName=doe, yearOfBirth=1996}}}...

I want to get count based on yearOfBirth. How should I do it?

I tried doing stats count by request.data.yearOfBirth, and also tried simply doing stats count by yearOfBirth but neither returned any results. Am I accessing the yearOfBirth field incorrectly?
How can I 

Labels (1)
0 Karma

somesoni2
Revered Legend

Check what fields are available in your data by checking field sidebar (left hand panel when you run your search). You can click on a field so see what way the field should be referred. 

If you don't see any relevant field extracted, make sure that you're using correct Search mode (dropdown below time range picker, select Smart Mode OR Verbose Mode). If you still don't see a field for yearOfBirth, try this

your base search (index=x sourcetype=y)
| rex "yearOfBirth\=(?<yearOfBirth>\d+)"
| stats count by yearOfBirth
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...