Splunk Search

Datas are not getting parsed after giving table name on splunk query.

Splunk-Star
Loves-to-Learn Lots

Please let me know the correct data extraction?

 

index=* "Unknown message for StatusConsumer" topicId marshall
| rex field=_raw "\"topicId\":\"(?<topicId>\d+)\""
| table topicId

 

Datas are not getting parsed after giving table name on splunk query.

Labels (3)
0 Karma

Splunk-Star
Loves-to-Learn Lots

regex was not applied correctly thats why it was not extracting the data.

 

Thank you

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Please post an example of your data containing topicid

 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Splunk-Star,

After using table or stats commands Splunk shows only outputs of these commands. This does not mean they are not extracted. If you need to access other fields, add them to the table command. 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...