Splunk Search

extract pattern like splunk pattern

indeed_2000
Motivator

Hi, How can I extract pattern of raw data like pattern tab in splunk search?

 

indeed_2000_1-1641359719713.png

 

Thanks

Labels (5)
0 Karma

SinghK
Builder

normally sourcetype is defined in inputs. and it should auto populate in search. 

0 Karma

indeed_2000
Motivator

would you please describe more?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can save the patterns as eventtypes and then use these eventtype in your searches e.g.

eventtype="saved_event_type"

but these are just short cuts / macros for what you would put in your initial search, they are not rex patterns (for example).

0 Karma

indeed_2000
Motivator

sourcetype not important. I just have index="myindex" 

need to get output like mention in screenshot.

Any idea?

Thanks,

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean you want the algorithm splunk uses to determine what patterns exist in the data and what percent of the events match those patterns?

0 Karma

indeed_2000
Motivator

Exactly need to use this in search app.

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...