Splunk Search

does not appear in the field

Path Finder

Hi all

I have event like that.
2019-10-26 15:00:09.158, servicename="ROOT2", area="SCP", place="tokyo", path="AAA12345", Default="B", Sn="B", SC="B", update="person"

"path" "place" "area" "servicename" and "Sn" are automatically appear in the field.
When a field is specified, a value such as B appears.

But  "SC" did not appear automatically. I think it is few.

I need value like B.
I want to make table.

index=main |table path, area, Sn, SC

path,area,Sn,SC
AAA12345,tokyo,B,B
AAA23456,osaka,A,A
AAA34567,nagoya,C,A

What should I do?

Thank you for helping.

0 Karma
1 Solution

Communicator

You can use regex in the query for extracting 'SC' value.
ex:

SC=\"(?<sc>\w*)\"

View solution in original post

Esteemed Legend

Add this as the first pipe in your SPL:

... | rex "SC=\"(?<SC>[^\"]+)\" ...
0 Karma

Communicator

You can use regex in the query for extracting 'SC' value.
ex:

SC=\"(?<sc>\w*)\"

View solution in original post

Path Finder

Thank you for helping.
but, it does not work well.

0 Karma

Path Finder

when I used |rex field=_raw
It work well.
Thank you.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!