Splunk Search

how to create index of new device data source in splunk enterprise ? and how to create its fields by extracting fields using regex?

pacifikn
Communicator

Greetings!!

how to create index of the new device data source in Splunk enterprise 7.2.6 in Linux? and how to create its fields by extracting fields using regex from events that come from the Web application Firewall to fetch relevant information fields?how to extract using regex and get meaningful information in fields,

I really need your help, thanks in advance!

Labels (3)
0 Karma

gcusello
Legend

Hi @pacifikn,
you could start with the Fundamentals I course ( https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html ) and the Search Tutorial ( https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchTutorial/WelcometotheSearchTutorial ) then on Google you can find some video to help you.

Anyway, to create a new index it's very easy [Settings -- Indexes -- New Index].

About field extraction, there a guided procedure that you can activate in two methods:

  • run a search on the data to extract a field,
  • click on the link on the left "Extract New Fields" and follow the guided procedure,

or

  • run a search on the data to extract a field,
  • click on ">",
  • click on "Event Actions",
  • click on "Extract Fields and follow the guided procedure.

If you have a good experience on regexes, you can also try your regex on regex101.com and use it in [Settings -- Fields -- Field Extraction -- New Field Extraction OR Open Field Extractor].

You can also find some additional info at:
https://docs.splunk.com/Documentation/Splunk/8.0.4/Knowledge/ExtractfieldsinteractivelywithIFX
https://www.youtube.com/watch?v=zIjeCYafLCE
https://www.youtube.com/watch?v=qN5llvXHaIs
https://www.splunk.com/view/SP-CAAADUY

At the end, on Answers you can find some useful informations.

Ciao.
Giuseppe

0 Karma

to4kawa
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

REST API Endoint to create correlation search

Hello, Is it possible to create correlation search in splunk ES app using REST API?

Does Splunk SOAR support mTLS

In the context of connecting Splunk Cloud and Phantom. Does Phantom/Splunk SOAR support mTLS?

Should our Deployment Servers have the Search Head server role on them?

all of our stuff is on premcurrently our dedicated Deployment Servers also have the Search Head role on them, ...