Splunk Search

extract pattern like splunk pattern

indeed_2000
Motivator

Hi, How can I extract pattern of raw data like pattern tab in splunk search?

 

indeed_2000_1-1641359719713.png

 

Thanks

Labels (5)
0 Karma

SinghK
Builder

normally sourcetype is defined in inputs. and it should auto populate in search. 

0 Karma

indeed_2000
Motivator

would you please describe more?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can save the patterns as eventtypes and then use these eventtype in your searches e.g.

eventtype="saved_event_type"

but these are just short cuts / macros for what you would put in your initial search, they are not rex patterns (for example).

0 Karma

indeed_2000
Motivator

sourcetype not important. I just have index="myindex" 

need to get output like mention in screenshot.

Any idea?

Thanks,

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean you want the algorithm splunk uses to determine what patterns exist in the data and what percent of the events match those patterns?

0 Karma

indeed_2000
Motivator

Exactly need to use this in search app.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...