I have the following log that Splunk is not recognizing well :
msg=id=123342521352 operation=write
How can I write a query so that ID is parsed by itself?
The goal is to be able to build a table like :
id | operation |
123342521352 | write |
Unfortunately, when I tried
table id operation
The id is always empty as it does not seem to be parsed correctly
If you look at events, you'll find the field msg with "id" as value. In SPL, you can use rex to extract id as a field, e.g.,
| rex "msg=id=(?<id>\d+)"
If you look at events, you'll find the field msg with "id" as value. In SPL, you can use rex to extract id as a field, e.g.,
| rex "msg=id=(?<id>\d+)"