Getting Data In

How to extract this data from the log?

as2050
New Member

Hello,

I am fairly new to using splunk. I am having some trouble understanding how to extract the fields. 

My sample data looks somewhat like this:

...Event={request=Request{data={firstName=jane, lastName=doe, yearOfBirth=1996}}}...

I want to get count based on yearOfBirth. How should I do it?

I tried doing stats count by request.data.yearOfBirth, and also tried simply doing stats count by yearOfBirth but neither returned any results. Am I accessing the yearOfBirth field incorrectly?
How can I 

Labels (1)
0 Karma

somesoni2
Revered Legend

Check what fields are available in your data by checking field sidebar (left hand panel when you run your search). You can click on a field so see what way the field should be referred. 

If you don't see any relevant field extracted, make sure that you're using correct Search mode (dropdown below time range picker, select Smart Mode OR Verbose Mode). If you still don't see a field for yearOfBirth, try this

your base search (index=x sourcetype=y)
| rex "yearOfBirth\=(?<yearOfBirth>\d+)"
| stats count by yearOfBirth
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...