Splunk Search

Searching logfile unrecognised key value pairs

smudge797
Path Finder

Whats the best way to search on the fields within a log that are not automatically recognised as key value pair?

So if i wanted to search on UniqueRequestGUID & XPID values (and display results in a table) below:

2014-06-26T04:56:31.105-07:00 - INFO
RequestType:SFPRe
UniqueRequestGUID:c17d9d1e-9cf8-4866-a166-bc5b4c96374a
ProductType:0
XPID:1
EPID:0
ProductCode:
YGDB_Conn:0
YGDB_RequestDuration:9
Payment:false

Tags (3)
0 Karma

somesoni2
Revered Legend

Try this

props.conf

[YourSourceType]
REPORT-requestfields = transform_requests

transforms.conf

[transform_requests]
DELIMS = "\n", ":"
CLEAN_KEYS = true
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...