Splunk Enterprise

Escape character in splunk

leandromatperei
Path Finder

Hello friends. I have the log file below and I need to extract exactly the specified value from a line

 

attr_itx_is_online [int] = 0
attr_itx_is_locked [int] = 0
attr_itx_workbin_type_id [str] = "TESTE"
attr_itx_agent_id [str] = "TESTE_OLSONJU_6628"
attr_itx_received_at [str] = "2020-09-22T17:45:01Z"
attr_itx_submitted_at [str] = "2020-09-22T17:45:51Z"
attr_itx_delivered_at [str] = "2020-09-22T18:47:06Z"
attr_itx_placed_in_queue_at [str] = "2020-09-22T17:46:06Z"

 

 
I need to capture the values ​​that have this beginning and the date starts with attr_itx_submitted_at [str] ="2020-05"

it's possible ?

Labels (1)
Tags (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

Events you posted is single event or multi events?

do you want to apply search filter to see only events that are matched with you keyword given by you or you want to extract the value to new field?

————————————
If this helps, give a like below.
0 Karma

leandromatperei
Path Finder

Hello, there are multiple events, but what interests me are these events "attr_itx_submitted_at [str] ="

I want to see only the results where this string contains the date 20-05

Attached I am sending you how these events are seen in the log. Tha is, "attr_itx_submitted_at [str] = "2020-05-*""

attr_itx_submitted_at [str] = "2020-09-22T19:40:46Z"
attr_itx_submitted_at [str] = "2020-09-22T19:40:46Z"
attr_itx_submitted_at [str] = "2020-09-22T19:40:46Z"
attr_itx_submitted_at [str] = "2020-09-22T19:40:46Z"
attr_itx_submitted_at [str] = "2020-09-22T19:40:46Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:16Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:16Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:16Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:05Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:05Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:05Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:05Z"

 

0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...