Splunk Search

how to create index of new device data source in splunk enterprise ? and how to create its fields by extracting fields using regex?

pacifikn
Communicator

Greetings!!

how to create index of the new device data source in Splunk enterprise 7.2.6 in Linux? and how to create its fields by extracting fields using regex from events that come from the Web application Firewall to fetch relevant information fields?how to extract using regex and get meaningful information in fields,

I really need your help, thanks in advance!

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pacifikn,
you could start with the Fundamentals I course ( https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html ) and the Search Tutorial ( https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchTutorial/WelcometotheSearchTutorial ) then on Google you can find some video to help you.

Anyway, to create a new index it's very easy [Settings -- Indexes -- New Index].

About field extraction, there a guided procedure that you can activate in two methods:

  • run a search on the data to extract a field,
  • click on the link on the left "Extract New Fields" and follow the guided procedure,

or

  • run a search on the data to extract a field,
  • click on ">",
  • click on "Event Actions",
  • click on "Extract Fields and follow the guided procedure.

If you have a good experience on regexes, you can also try your regex on regex101.com and use it in [Settings -- Fields -- Field Extraction -- New Field Extraction OR Open Field Extractor].

You can also find some additional info at:
https://docs.splunk.com/Documentation/Splunk/8.0.4/Knowledge/ExtractfieldsinteractivelywithIFX
https://www.youtube.com/watch?v=zIjeCYafLCE
https://www.youtube.com/watch?v=qN5llvXHaIs
https://www.splunk.com/view/SP-CAAADUY

At the end, on Answers you can find some useful informations.

Ciao.
Giuseppe

0 Karma

to4kawa
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...