Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Field extraction
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I want to create report for events whose field names haven't been extracted. I have SSH logs of the format "Accepted publickey for user XYZ" , "Accepted publickey for user ABC" and so on. I want to collect statistics for XYZ and other users. When I test an extraction, I get a javascript error on page which says invalid argument. Even if I save a field extraction, I'm not able to use it in my search. Can someone please tell me how to go about it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am not sure why you getting java script error maybe an issue with your browser...
There are several methods to extract fields:
First i usually use erex to see what regex will catch my field values:
... | erex user examples="XYZ, ABC" counterexamples="99/2"
Then it will give me a regex which i would use in rex command:
... | rex field=_raw "Accepted\spublickey\sfor\suser\s(?<user>.*[^\s]) "
Then I Use the Field extractions page in Manager.
Here you will find all the methods to extract fields : Fields and field extractions
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am not sure why you getting java script error maybe an issue with your browser...
There are several methods to extract fields:
First i usually use erex to see what regex will catch my field values:
... | erex user examples="XYZ, ABC" counterexamples="99/2"
Then it will give me a regex which i would use in rex command:
... | rex field=_raw "Accepted\spublickey\sfor\suser\s(?<user>.*[^\s]) "
Then I Use the Field extractions page in Manager.
Here you will find all the methods to extract fields : Fields and field extractions
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That worked perfectly! Thanks.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster
What's New in Splunk Enterprise Security 8.8 and Beyond
A Four-Part Event Series: State of Observability - Where AI Meets Performance
