I am very new to both regex and splunk...
If I have a particular field in the middle of a bunch of data. How do I make that field tied to say the next ~7 characters following it. When I use the field extractor it does not realize that I want to get meaningful data from the information directly after the field's name.
For instance if I have something like image=RandomImageName what is the best way to report on how often the different RandomImageNames appear over time.
I would really appreciate it if someone could just point me in the right direction.
Hello KindaWorking,
For the first question, could you pls provide some example of the Raw event data to assist with the Regex?
Regarding the second question, I'm assuming "image" is a field already extracted from your events, you should be able to just run a command like:
index=main "your search if applicable" | timechart count by image
Have a look on http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Timechart to see all options for timechart
Cheers,
Thanks for the help so far. Here is an example:
0.0.0.0 - - [27/Nov/2014:09:48:50 +1100] "GET /pdf.cfm?handle=afcacyc2&IMAGE=RANDOMIMAGENAME-V%20200&src=Direct HTTP/1.1" 302 69 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)";
If you see there is in the middle there IMAGE=RANDOMIMAGENAME
I want to be able to report on the data RANDOMIMAGENAME.
Thanks for the help