Splunk Dev

unstructured logs how to extract the given item example

mindia
New Member

The unsturctured log contains many lines and at the end below coverage report, it is not getting captured as a field, even Extract new field, when I tried, it is adding junk data in the fields covering other lines

line1
line2
..
...
line n
============ coverage report ==========
Statements : 34% (20/22)

Lines : 56% (56/100)

Is it possible to create a search query which would generate the table like

_time Statements Lines
14-9-2018 34% 56%

Since the coverage report is unstructured not able to capture the details as a field.... any suggestions are welcome.

Thanks!.

Tags (1)
0 Karma

493669
Super Champion

Hi @mindia,
you can try this on raw data :

...|rex "Statements : (?<Statements>[^\s+]+).*Lines : (?<Lines>[^\s+]+)"|table _time, Statements , Lines
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...