Splunk Search

Extracting data out of fields correctly



I have a dataset like this :


Now after importing my data in splunk I am not getting the correct data in the fields

When I did like this :
field1="XXXX YYYYY" field2="ZZZZZZ:AAAAAA" field3="BBBBBB" field4="CCCCCC DDDDDDDD"

Then it worked, but in the raw log manually it is not possible to decorate the data as it is big in size

Can this type of formation can be made before importing the data into SPLUNK ?

Thanks in advance

0 Karma


I would make a field transformation, with a regex, that seperates the fields by "-"...

I'm not an expert in regex, but you need to search something like that :

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...