Splunk Search

extract pattern like splunk pattern

indeed_2000
Motivator

Hi, How can I extract pattern of raw data like pattern tab in splunk search?

 

indeed_2000_1-1641359719713.png

 

Thanks

Labels (5)
0 Karma

SinghK
Builder

normally sourcetype is defined in inputs. and it should auto populate in search. 

0 Karma

indeed_2000
Motivator

would you please describe more?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can save the patterns as eventtypes and then use these eventtype in your searches e.g.

eventtype="saved_event_type"

but these are just short cuts / macros for what you would put in your initial search, they are not rex patterns (for example).

0 Karma

indeed_2000
Motivator

sourcetype not important. I just have index="myindex" 

need to get output like mention in screenshot.

Any idea?

Thanks,

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean you want the algorithm splunk uses to determine what patterns exist in the data and what percent of the events match those patterns?

0 Karma

indeed_2000
Motivator

Exactly need to use this in search app.

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...