Splunk Search

extract pattern like splunk pattern

indeed_2000
Motivator

Hi, How can I extract pattern of raw data like pattern tab in splunk search?

 

indeed_2000_1-1641359719713.png

 

Thanks

Labels (5)
0 Karma

SinghK
Builder

normally sourcetype is defined in inputs. and it should auto populate in search. 

0 Karma

indeed_2000
Motivator

would you please describe more?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can save the patterns as eventtypes and then use these eventtype in your searches e.g.

eventtype="saved_event_type"

but these are just short cuts / macros for what you would put in your initial search, they are not rex patterns (for example).

0 Karma

indeed_2000
Motivator

sourcetype not important. I just have index="myindex" 

need to get output like mention in screenshot.

Any idea?

Thanks,

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean you want the algorithm splunk uses to determine what patterns exist in the data and what percent of the events match those patterns?

0 Karma

indeed_2000
Motivator

Exactly need to use this in search app.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Catalog Is Now Generally Available on Splunk Cloud Platform

A Unified View of Your Data  Security logs, application events, business data, and historical telemetry often ...

Developer Spotlight with Eduard Lekanne

From Network Engineer to Building Agentic AI for Splunk Eduard Lekanne has been architecting technology ...

From Data Landing to Insight

Search Across More of Your Data Ecosystem The data you need may live in Splunk, high-volume machine data, ...