Splunk Search

How to extract all my fields from the log?

karthi2809
Contributor

2018-07-19 02:05:13,901|3801531980313892|MA_SE|aabbcc|12121212|10|FGH|lOP|||EMAIL|KARTHI@GMAIL.COM|LEVEL2|12/22/2017|12/31/9999|FATAL|E0021|Member not found

0 Karma

poete
Builder

Hello @karthi2809,

I did a bit of the rex to get you started.

| makeresults
| eval fields="2018-07-19 02:05:13,901|3801531980313892|MA_SE|aabbcc|12121212|10|FGH|lOP|||EMAIL|KARTHI@GMAIL.COM|LEVEL2|12/22/2017|12/31/9999|FATAL|E0021|Member not found" 
| rex field=fields "^(?<datetime>[0-9- :,]+)\|(?<numFiled1>[0-9]+)\|(?<someTextField1>[A-Z_]+)\|(?<someTextField2>[a-z])"

Please start from the field extraction above to accomodate it with your events.

0 Karma

deepashri_123
Motivator

Hey@karthi2809,

You can try using field extractor and use | as delimiter and rename your fields extracted.
https://docs.splunk.com/Documentation/SplunkCloud/latest/Knowledge/ExtractfieldsinteractivelywithIFX

Let me know if this helps!!!

0 Karma

karthi2809
Contributor

I am not using sourcetype to extract

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...