Splunk Search

Extracting data out of fields correctly

abhayneilam
Contributor

Hi,

I have a dataset like this :

field1=XXXX YYYYY-field2=ZZZZZZ:AAAAAA-field3=BBBBBB-field4=CCCCCC DDDDDDDD

Now after importing my data in splunk I am not getting the correct data in the fields

When I did like this :
field1="XXXX YYYYY" field2="ZZZZZZ:AAAAAA" field3="BBBBBB" field4="CCCCCC DDDDDDDD"

Then it worked, but in the raw log manually it is not possible to decorate the data as it is big in size

Can this type of formation can be made before importing the data into SPLUNK ?

Thanks in advance

0 Karma

sbsbb
Builder

I would make a field transformation, with a regex, that seperates the fields by "-"...

I'm not an expert in regex, but you need to search something like that :
(?P[^-]+)-(?P[^-]+)...

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...