INFO, ERROR and FATAL

[ycalpu]

Hi all, if a log has the following types of log entries (INFO, ERROR, FATAL), how do I get splunk to recognise those entries as a field.
YC

[lukejadamec]

Run a search that pulls only that source or sourcetype and use the field extractor. I prefer to use a source when specifying an automated field extraction.

[lukejadamec]

I use the field extractor and call the field LogLevel.

[martin_mueller]

Do post some representative sample events.