Splunk Search

Create a field and then make a graph based on the different inputs to that field over time.

KindaWorking
Path Finder

I am very new to both regex and splunk...
If I have a particular field in the middle of a bunch of data. How do I make that field tied to say the next ~7 characters following it. When I use the field extractor it does not realize that I want to get meaningful data from the information directly after the field's name.

For instance if I have something like image=RandomImageName what is the best way to report on how often the different RandomImageNames appear over time.

I would really appreciate it if someone could just point me in the right direction.

Tags (3)
0 Karma

musskopf
Builder

Hello KindaWorking,

For the first question, could you pls provide some example of the Raw event data to assist with the Regex?

Regarding the second question, I'm assuming "image" is a field already extracted from your events, you should be able to just run a command like:

index=main "your search if applicable" | timechart count by image

Have a look on http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Timechart to see all options for timechart

Cheers,

0 Karma

KindaWorking
Path Finder

Thanks for the help so far. Here is an example:

0.0.0.0 - - [27/Nov/2014:09:48:50 +1100] "GET /pdf.cfm?handle=afcacyc2&IMAGE=RANDOMIMAGENAME-V%20200&src=Direct HTTP/1.1" 302 69 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)";

If you see there is in the middle there IMAGE=RANDOMIMAGENAME
I want to be able to report on the data RANDOMIMAGENAME.
Thanks for the help

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...