Splunk Search

extract pattern like splunk pattern

indeed_2000
Motivator

Hi, How can I extract pattern of raw data like pattern tab in splunk search?

 

indeed_2000_1-1641359719713.png

 

Thanks

Labels (5)
0 Karma

SinghK
Builder

normally sourcetype is defined in inputs. and it should auto populate in search. 

0 Karma

indeed_2000
Motivator

would you please describe more?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can save the patterns as eventtypes and then use these eventtype in your searches e.g.

eventtype="saved_event_type"

but these are just short cuts / macros for what you would put in your initial search, they are not rex patterns (for example).

0 Karma

indeed_2000
Motivator

sourcetype not important. I just have index="myindex" 

need to get output like mention in screenshot.

Any idea?

Thanks,

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean you want the algorithm splunk uses to determine what patterns exist in the data and what percent of the events match those patterns?

0 Karma

indeed_2000
Motivator

Exactly need to use this in search app.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Analytics Workspace deprecation

As of Splunk Cloud Platform 10.4.2604 and Splunk Enterprise 10.4, Analytics Workspace is now deprecated. ...

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

Splunk Developer Day brought the Splunk developer community together for a practical look at what it means to ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...