Splunk Search

Splunk Search content for a particular string

kaushal21rajput
New Member

Hi Team,

I have search in search head which gives output like in snapshot.
Now i want to assign a new field to client no like client 26 , client 31 . All these (client 26, client 31 etc) should have a particular field.
I have tried to used eval command but did not get exact function to be used.
Please help me . Snapshot is attached.alt text

Tags (1)
0 Karma

FrankVl
Ultra Champion

Assuming you want to extract the number into a field called client, you can do that using the rex command:

| rex "client\s+(?<client>\d+)\s+connected"

ddrillic
Ultra Champion

I think Frank meant - client\s+(?<client>\d+)\s+connected

FrankVl
Ultra Champion

Oh, yeah, sorry, forgot to post it as code, which makes the triangular brackets disappear. Fixed it 🙂

0 Karma

ddrillic
Ultra Champion

Fun stuff ; -)

0 Karma

kaushal21rajput
New Member

Hi Ddrillic/FrankVI ,

I want to assign output value like "client 26 , client 36" to an another field .

These values should be visible in interesting fields.

That is my question.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...