Splunk Search

Creating a Log for use with Splunk

eulalie
New Member

We have an application that does NOT generate it's own logs. We are in a position where we can get the logs generated on the fly to be able to do a report showing a timeline based on logs from 4 systems.

The applications owner can generate the logs in almost any format we want. I had him generate a log with the format:

FIELD1="VALUE1" FIELD2="VALUE2"

Where field 1 happens to be the event time and field 2 happens to be username. I added OR FIELD2=VALUE to my search and added the fields for FIELD1 and FIELD2 to my | table.

I have two problems. I assume the second is a result of the first. When I look at that file only in splunk it shows me the events and it seems to extract the fields, however when I do a search it does not. The other issue is that it doens't appear to be viewing FIELD1 as the even date and time.. it's just another field with some data in it.

The application can give me CSV or TXT files. How should I get it formatted for Splunk to know what we're going for?

Tags (1)
0 Karma

Damien_Dallimor
Ultra Champion
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...