Splunk Search

How to parse my sample raw data to so I can search for Parameter=SomeValue in Splunk?

Stevelim
Communicator

Not exactly sure how to phrase this, but how can I remodel my data input via Splunk?

For example, my raw data looks like this:

Tag= Parameter Value =2 

Parameter = 2 in Splunk such that I can search for Parameter = Some Value

0 Karma

sundareshr
Legend

In your transforms.conf, add this

[unique_stanza_name]
REGEX = Tag=\s?(\w+)\s+Value\s?=(\d+)
FORMAT = $1::$2

Here's more on how that works

0 Karma

Stevelim
Communicator

Hey Sundaresh,

I tried this out with a restart, I didnt notice anything. Also, i added the transforms.conf under etc/system/local

Am I doing this right?

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...