Monitoring Splunk

How to extract all the fields after a certain string in splunk

aaa2324
Engager

In below eg I have some random text after the word type and I want to extract all the strings/ numbers that comes after type, can it be done using Rex ? Please suggest the command 

type abc xyz aabbbbc xxxxyyyy bbbbb uuuuuu 12345677

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @aaa2324,

if you want to extract all the text after "type", you have to use a regex like the following:

| rex "type\s+(?<your_field>.*)"

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aaa2324,

if you want to extract all the text after "type", you have to use a regex like the following:

| rex "type\s+(?<your_field>.*)"

Ciao.

Giuseppe

View solution in original post

0 Karma

aaa2324
Engager

Thanks a lot it works 👍

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aaa2324,

Good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.