Get instance name from source

[bcalder]

Hi all,

I am completely new to Splunk so I apologize if this has been asked/answered. I did review the past discussions but could not find a solution to my question.

I have incoming logs that look similar to this

28 Feb 2021 13:53:23,815[MANDATORY][JAS]Initiating EnterpriseOne startup using configuration location (default_path) as 'C:\jde_home\SCFHA\targets\HTML_PD1_82\config'.

I would like to be able to search for the string "Initiating EnterpriseOne startup " and create a dashboard table showing the date, time and the substring HTML_PD1_82. The idea being, I would like to keep track of when each machine was restarted.

Can anyone help with the Search pattern? Thanks in advance. 

Bruce

[richgalloway]

Perhaps this will get you started.

index=foo "Initiating EnterpriseOne startup"
| rex "targets\\\(?<machine>[^\\\]+)"
| table _time machine

[bcalder]

Thanks @richgalloway That worked great. I ended up with 

index=* "Initiating EnterpriseOne startup"
| rex "targets\\\(?<machine>[^\\\]+)" | table machine _time
| dedup machine
| sort machine

As  newbie, I appreciate your input.

I'm sure there is documentation out there somewhere. Now if I can just find it. ;^o

Bruce

[richgalloway]

For documentation, see https://docs.splunk.com/Documentation/Splunk/8.1.2/Search/GetstartedwithSearch and https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/WhatsInThisManual