Splunk Search

Creating a Log for use with Splunk

eulalie
New Member

We have an application that does NOT generate it's own logs. We are in a position where we can get the logs generated on the fly to be able to do a report showing a timeline based on logs from 4 systems.

The applications owner can generate the logs in almost any format we want. I had him generate a log with the format:

FIELD1="VALUE1" FIELD2="VALUE2"

Where field 1 happens to be the event time and field 2 happens to be username. I added OR FIELD2=VALUE to my search and added the fields for FIELD1 and FIELD2 to my | table.

I have two problems. I assume the second is a result of the first. When I look at that file only in splunk it shows me the events and it seems to extract the fields, however when I do a search it does not. The other issue is that it doens't appear to be viewing FIELD1 as the even date and time.. it's just another field with some data in it.

The application can give me CSV or TXT files. How should I get it formatted for Splunk to know what we're going for?

Tags (1)
0 Karma

Damien_Dallimor
Ultra Champion
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...