Getting Data In

How to extract this data from the log?

as2050
New Member

Hello,

I am fairly new to using splunk. I am having some trouble understanding how to extract the fields. 

My sample data looks somewhat like this:

...Event={request=Request{data={firstName=jane, lastName=doe, yearOfBirth=1996}}}...

I want to get count based on yearOfBirth. How should I do it?

I tried doing stats count by request.data.yearOfBirth, and also tried simply doing stats count by yearOfBirth but neither returned any results. Am I accessing the yearOfBirth field incorrectly?
How can I 

Labels (1)
0 Karma

somesoni2
Revered Legend

Check what fields are available in your data by checking field sidebar (left hand panel when you run your search). You can click on a field so see what way the field should be referred. 

If you don't see any relevant field extracted, make sure that you're using correct Search mode (dropdown below time range picker, select Smart Mode OR Verbose Mode). If you still don't see a field for yearOfBirth, try this

your base search (index=x sourcetype=y)
| rex "yearOfBirth\=(?<yearOfBirth>\d+)"
| stats count by yearOfBirth
0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...