Field Extractions

itsmevic · ‎07-31-2020

Hello I have a basic search that I am running from the following:

index=sso

This search returns a lot of events. Within those log events, I would like to extract two pieces of information and create fields for them both, they are:

"saml:Issuer" AND "saml:Audience>https://"

I'd then like to run a simple query against these two new fields

index=sso sourcetype="pingfed*"

table saml:Issuer saml:Audience>https://

What would be the most efficient way of doing this field extraction step-by-step?

richgalloway · ‎07-31-2020

Please share some sample events.

---
If this reply helps you, Karma would be appreciated.

Field Extractions

configuration

metrics

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Manage Edge Processor pipelines end to end with APIs

Join the Conversation

Field Extractions

configuration

metrics

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Manage Edge Processor pipelines end to end with APIs