Splunk Search

field extraction



I have a log files which are having columns that are not fixed.
if first log entry has col1,col2,col3 then next entry can have col4,col5 only can i analyze and extract fields from such columns

Thanks and Regards

Tags (2)
0 Karma


If you have diffrent searches for diffrent column combination then just extract fields from Splunk UI.

0 Karma


Please provide us with sample logs. Try extracting the logs from Splunk UI, remove the matches which you don't want.

0 Karma