Does anyone have a data curation search that I snag? Looking for logs and values which are not currently done in key values.
Did you try...
your search ... key!=value
This should give the events which doesnt have the values for the key specified above.
Hi daniel333, Check out the Patterns tab : http://docs.splunk.com/Documentation/Splunk/6.3.0/Search/Identifyeventpatterns
Search on a particular source or sourcetype, and it will give you an idea of what kind of events are in that data. At that point you might be able to pick out fields that you can build extractions on.
Let me know if this helps!
