Splunk Search

Extracting Fields & Regular Expression Formating

Path Finder

I have Active Directory logs that do not have many fields associated with them. Each log is over 100 lines and I wish to extract a lockoutTime field that is further down in the bottom of each log. When going to extract the field I cannot do the automatic method because it only shows me the first 15 to 20 lines. Is there a way to show the entire raw log to do an automatic scroll over extraction? If not how would I format the regular expression where my line is lockoutTime=0 and I want to extract lockoutTime to see all of the results for that field across my logs?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Write your own regex to extract the field. Start with this

lockoutTime=(?<lockoutTime>\d+)
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

Write your own regex to extract the field. Start with this

lockoutTime=(?<lockoutTime>\d+)
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Path Finder

This works perfectly thank you.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!