how to create index of new device data source in splunk enterprise ? and how to create its fields by extracting fields using regex?

[pacifikn]

Greetings!!

how to create index of the new device data source in Splunk enterprise 7.2.6 in Linux? and how to create its fields by extracting fields using regex from events that come from the Web application Firewall to fetch relevant information fields?how to extract using regex and get meaningful information in fields,

I really need your help, thanks in advance!

[gcusello]

Hi @pacifikn,
you could start with the Fundamentals I course ( https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html ) and the Search Tutorial ( https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchTutorial/WelcometotheSearchTutorial ) then on Google you can find some video to help you.

Anyway, to create a new index it's very easy [Settings -- Indexes -- New Index].

About field extraction, there a guided procedure that you can activate in two methods:

• run a search on the data to extract a field,
• click on the link on the left "Extract New Fields" and follow the guided procedure,

or

• run a search on the data to extract a field,
• click on ">",
• click on "Event Actions",
• click on "Extract Fields and follow the guided procedure.

If you have a good experience on regexes, you can also try your regex on regex101.com and use it in [Settings -- Fields -- Field Extraction -- New Field Extraction OR Open Field Extractor].

You can also find some additional info at:
https://docs.splunk.com/Documentation/Splunk/8.0.4/Knowledge/ExtractfieldsinteractivelywithIFX
https://www.youtube.com/watch?v=zIjeCYafLCE
https://www.youtube.com/watch?v=qN5llvXHaIs
https://www.splunk.com/view/SP-CAAADUY

At the end, on Answers you can find some useful informations.

Ciao.
Giuseppe

[to4kawa]

Why don't you take a look at the reference first?

https://docs.splunk.com/Documentation/Splunk/latest/Data/Getstartedwithgettingdatain