- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Escape character in splunk
leandromatperei
Path Finder
09-22-2020
12:00 PM
Hello friends. I have the log file below and I need to extract exactly the specified value from a line
attr_itx_is_online [int] = 0
attr_itx_is_locked [int] = 0
attr_itx_workbin_type_id [str] = "TESTE"
attr_itx_agent_id [str] = "TESTE_OLSONJU_6628"
attr_itx_received_at [str] = "2020-09-22T17:45:01Z"
attr_itx_submitted_at [str] = "2020-09-22T17:45:51Z"
attr_itx_delivered_at [str] = "2020-09-22T18:47:06Z"
attr_itx_placed_in_queue_at [str] = "2020-09-22T17:46:06Z"
I need to capture the values that have this beginning and the date starts with attr_itx_submitted_at [str] ="2020-05"
it's possible ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

thambisetty

SplunkTrust
09-22-2020
12:19 PM
Events you posted is single event or multi events?
do you want to apply search filter to see only events that are matched with you keyword given by you or you want to extract the value to new field?
————————————
If this helps, give a like below.
If this helps, give a like below.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
leandromatperei
Path Finder
09-22-2020
12:56 PM
Hello, there are multiple events, but what interests me are these events "attr_itx_submitted_at [str] ="
I want to see only the results where this string contains the date 20-05
Attached I am sending you how these events are seen in the log. Tha is, "attr_itx_submitted_at [str] = "2020-05-*""
attr_itx_submitted_at [str] = "2020-09-22T19:40:46Z"
attr_itx_submitted_at [str] = "2020-09-22T19:40:46Z"
attr_itx_submitted_at [str] = "2020-09-22T19:40:46Z"
attr_itx_submitted_at [str] = "2020-09-22T19:40:46Z"
attr_itx_submitted_at [str] = "2020-09-22T19:40:46Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:16Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:16Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:16Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:05Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:05Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:05Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:05Z"
