Splunk Search

Create a field and then make a graph based on the different inputs to that field over time.

KindaWorking
Path Finder

I am very new to both regex and splunk...
If I have a particular field in the middle of a bunch of data. How do I make that field tied to say the next ~7 characters following it. When I use the field extractor it does not realize that I want to get meaningful data from the information directly after the field's name.

For instance if I have something like image=RandomImageName what is the best way to report on how often the different RandomImageNames appear over time.

I would really appreciate it if someone could just point me in the right direction.

Tags (3)
0 Karma

musskopf
Builder

Hello KindaWorking,

For the first question, could you pls provide some example of the Raw event data to assist with the Regex?

Regarding the second question, I'm assuming "image" is a field already extracted from your events, you should be able to just run a command like:

index=main "your search if applicable" | timechart count by image

Have a look on http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Timechart to see all options for timechart

Cheers,

0 Karma

KindaWorking
Path Finder

Thanks for the help so far. Here is an example:

0.0.0.0 - - [27/Nov/2014:09:48:50 +1100] "GET /pdf.cfm?handle=afcacyc2&IMAGE=RANDOMIMAGENAME-V%20200&src=Direct HTTP/1.1" 302 69 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)";

If you see there is in the middle there IMAGE=RANDOMIMAGENAME
I want to be able to report on the data RANDOMIMAGENAME.
Thanks for the help

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...