Splunk Search

Splunk search with regex

ss394546910
Engager

Hi everyone, I got lots of the blow _row after the search:

........

2002-02-22 17:32:15.592 somedatainformation ==> ASH.cctv.mary.CREDITCHECK.103294384.0000

2002-02-22 13:32:15.592 somedatainformation ==> ASH.cctv.mary.CREDITCHECK.103294384.0000

2002-02-22 13:30:15.222 somedatainformation ==> ASH.cctv.mary.CREDITCHECK.103292222.0002

......

how can I just get the string after the "==>" like "ASH.cctv.mary.CREDITCHECK.103294384.0000" and remove the duplicated value?

Thanks

Labels (1)
0 Karma
1 Solution

venkatasri
Influencer

Hi @ss394546910 

Can you try this?

<your_search> 
| rex "==\>\s(?<info>.+)" 
| dedup info
| table info

--

an upvote would be appreciated and Accept solution if this reply helps!

View solution in original post

venkatasri
Influencer

Hi @ss394546910 

Can you try this?

<your_search> 
| rex "==\>\s(?<info>.+)" 
| dedup info
| table info

--

an upvote would be appreciated and Accept solution if this reply helps!

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.