Splunk Search

How to parse my sample raw data to so I can search for Parameter=SomeValue in Splunk?

Stevelim
Communicator

Not exactly sure how to phrase this, but how can I remodel my data input via Splunk?

For example, my raw data looks like this:

Tag= Parameter Value =2 

Parameter = 2 in Splunk such that I can search for Parameter = Some Value

0 Karma

sundareshr
Legend

In your transforms.conf, add this

[unique_stanza_name]
REGEX = Tag=\s?(\w+)\s+Value\s?=(\d+)
FORMAT = $1::$2

Here's more on how that works

0 Karma

Stevelim
Communicator

Hey Sundaresh,

I tried this out with a restart, I didnt notice anything. Also, i added the transforms.conf under etc/system/local

Am I doing this right?

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...