How to access values from event in Splunk

[gauravepi]

I want to access the values of the events that are coming after splunk search .

Data is coming in below format on the event

18/06/28 14:12:07 250  219561  711914   72864    0  784778 - 18-06-28 14:08:43

I want to access certain values from this list like i want to access : 18/06/28 14:12:07 , 784778 and 18-06-28 14:08:43

Please suggest how we can do this in splunk ?

[woodcock]

I use Regex101.com for this: https://regex101.com/r/7bVxvt/1

This RegEx does the trick. Just set it up as a Field Extraction:

^(?<datetime1>\d+\/\d+\/\d+\s+\d+:\d+:\d+)\s+(?<field1>\d+)\s+(?<field2>\d+)\s+(?<field3>\d+)\s+(?<field4>\d+)\s+(?<field5>\d+)\s+(?<field6>\d+)\s+(?<field7>\S+)\s+(?<datetime2>\d+-\d+-\d+\s+\d+:\d+:\d+)

[kmorris_splunk]

It sounds like you want to extract fields from your data. This is assuming you are already ingesting it into Splunk. Depending on the type of data, you should always check splunkbase.com first to see if there is an app or add-on for that data source. The add-ons will have the field extractions done for these sources. If it is something custom or there isn't an add-on available, you can extract fields through the GUI see docs here.