Splunk Search

How to create a table?

minpd0309
Explorer

HI, I want to make the log below in the form of the table below. What should I do with the spl?

 

[log ex] 

14:39:19.857 INF [md_system_user] remove success [user id:kimkimkim] by [id:tom]

 

[table]

user id id
kimkimkim tom
Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @minpd0309,

you have to extract (using a regex) the fields and then run something like this:

index=your_index
| rex "\[user id:(?<user_id>\w+)\]\s+by\s+\[id:(?<id>\w+)"
| table user_id id

you can test the regex at https://regex101.com/r/HUeULf/1

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @minpd0309,

you have to extract (using a regex) the fields and then run something like this:

index=your_index
| rex "\[user id:(?<user_id>\w+)\]\s+by\s+\[id:(?<id>\w+)"
| table user_id id

you can test the regex at https://regex101.com/r/HUeULf/1

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...