How to get only second field=value from all events...

Splunk Search

Hi.
I have 500 events where only second line of event have value for me.
How to get that information from all events?

Can you provide some sample events and what you have tried so far?

Get Updates on the Splunk Community!

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members! The ...

Join the Conversation