Splunk Search

CEF Field Parsing

riqbal47010
Path Finder

I am not seeing extracted field against below query.

index=fireeye | eval {flexString2Label} = flexString2

below are crossponding values in CEF format
flexString2Label = subjcect

flexString2 = "a test message"

Please advise that what I a missing

Labels (1)
Tags (2)
0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults 
| eval flexString2Label = "subject",flexString2 = "a test message" 
| eval {flexString2Label} = flexString2

this is OK.
maybe, flexString2Label OR flexString2 field does not extracted.

View solution in original post

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval flexString2Label = "subject",flexString2 = "a test message" 
| eval {flexString2Label} = flexString2

this is OK.
maybe, flexString2Label OR flexString2 field does not extracted.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...